You just got hired at company A and the old administrator is no longer there. Requests start coming through for adding users to the internet restrict group. When you look at the groups none of the names make sense and there is no documentation out there to explain what each group has rights to and what it does. That would raise concern to me. For security how do you know if everyone has the correct rights.
How would you discover what the groups have rights to? Is there a tool out there that will find this information for you?
Best Answer
You don't. There's so many things, you essentially can't do it unless you already know the entire environment anyway. See : How can I check access of a Group/User in AD before I delete it?
Look at Ben Pilbrow's answer for a partial list of the things that an entity in AD can be given rights to. If you know every application in your environment that can have an AD entity get an ACL assigned to it, then you can query each of them for every ACL.