I need a program/script that will allow me to find out
what folder/shares and on what server a domain global
group belong to.
Groups don't "belong to" share or folders. Groups may be
given access so I presume this is what you mean.
There is no built-in utility for doing this, in fact it would require
a network scan of ever (possible) machine, perhaps starting
from the list of machines in AD but recognizing that any machine
in the forest or in another domain which trusts us can also use
this group, AND THEN a full scan of ever drives, every subdirectory
using something like XCacls (or better yet a custom program.)
SubInAcl.exe -- resource kit -- can help but is not the full solution.
Oh, and usually a Global Group should not be used for assigning
such permissions (use Local groups) so the FULL solution much
account for which Local groups (local on the domain OR the
machine) include the Global Group in question.
In Native Mode it is worse, since Group Nesting is possible you
might need to do includes of includes and check the Universal
groups also.
If you have a small environment you might simplify by assuming
these conditions do not exist.
