Double-Click the Direct Membership Query, or Select it then click Query Properties. Select configure in the pop-up window to view the USERSGROUPS GUI. Clicking the ellipses (…) under “All users in the following groups:” allows you to Select the relevant groups you would like to include with the collection, seen here:
Connecting to a blank host brings back local groups, and can be scoped to hosts with known desired groups to be included. I personally like to include Backup Operators and Remote Desktop Users to get richer audit results. Save the settings and include the new groups within the Expand Effective Membership analysis located within the Configure > Analysis of the same job. The WHERE statement needs to be changed from ‘=’ to ‘IN’ with a parenthesis around the desired group names like I’ve done below:
Save and Close, and finally run as usual. Now our report will contain those new groups and can be filtered/scoped as desired:
Leave a Reply