Relevance for members of "global" groups

Content Authoring
1

Help is needed, I have an Analysis which gather the member of local groups, now I want to make yet another one, which gathers the members of “global” groups, the result should be similar to the one I can get from the command line by using “net group xxx /domain”. Haven’t been able to find any inspectors, which gives me that.

Thanks in advance

2

I think you are talking about this:
https://developer.bigfix.com/relevance/reference/active-directory-group.html

Keep in mind there will be caching on the endpoint when you hit these inspectors.

3

Thanks for the answer, I have looked at these inspectors, but can’t see, how to get the wanted information. Can’t find a way to get the members of all “global” groups on any given server.

What I want is something similar to the relevance below on local groups :
"(names of it, members of it, ((year of it as string & “-” & month of it as two digits & “-” & day_of_month of it as two digits) of date(local time zone) of it & " “& (two digit hour of it as string & “:” & two digit minute of it as string & “:” & two digit second of it as string) of time (local time zone) of it) of now) of local groups”

4

Sounds very expensive to your AD controllers. Recursing all members of all AD groups seems like something you would not want to do on all your computers many times a day.

Is there a follow on reason for wanting this information polled from every BigFix endpoint?

If you were doing this inside an action, you might use the net group xxx /domain command and redirect >> the output to a file for further processing?

5

We only want to do this on our PDC’s and only once a day. The result must be reachable from the REST API, which is why I would like to keep it to one analysis if possible, otherwise I must do it in two steps :

Gather the information to a file using a fixlet and a script
Make an analysis to gather the result from the file

6

I would use the 2 step method and set step 1 as a repeating policy action targeting just the PDCs once a day (at a low AD traffic time, not 9am when everyone is trying to log in, for example) and output to a file. Your analysis can then be setup to just read the output file. You could even have the modification time of the file as one of the properties in your analysis, so you know the “currency” of the data.