0

The current company I work for used to use Microsoft CRM, this was before I came. It was also removed before I came, however our current active directory contains a CRM category with tons of security groups etc.

No one and nothing seems to be connected to these groups.

What is the risk involved in removing these left over entries? I have been told not to, but I don't like them for some reason.

Arun Vinoth-Precog Tech - MVP
  • 314
  • 1
  • 3
  • 15
Jeff
  • 1,089
  • 5
  • 26
  • 46

2 Answers2

2

I think you mean there is an OU in AD that has all of these security groups in it. If that's the case and you want to get rid of it, I would just remove the access on that OU so only administrator have access and see if anyone yells. If all is quiet for a few weeks, you can go ahead and delete it.

I wouldn't just go deleting it though without knowing for sure if anything will break. AD object level restore is not a very fun task.

BoxerBucks
  • 1,374
  • 1
  • 9
  • 19
  • I second this. What you hope to do shouldn't cause any issues. The only way you will suffer ill effects from this is if these groups were used improperly to assign/deny rights to non-CRM related roles. – pk. Mar 23 '11 at 18:31
1

If the security groups in these OUs are named like

PrivReportingGroup {GUID}
PrivUserGroup {GUID}
ReportingGroup {GUID}
SQLAccessGroup {GUID}
UserGroup {GUID}

and the CRM System is not existing anymore you can safely remove them. These groups are used by Dynamics CRM to manage application and user security.

See the list of Microsoft Dynamics CRM Server installed configuration components for reference. In order to remove the remains manually see How to manually remove the Microsoft Dynamics CRM 4.0 server

ccellar
  • 213
  • 2
  • 14
  • to be honest, this CRM system has been gone for over 5 years. I have removed almost all of the security groups under the main CRM OU, and nothing has broken. so I am contemplating just removing the entire CRM OU and subitems from the AD. We built our own inhouse CRM in .net that is used in the company, and does not use AD for anything – Jeff Apr 14 '11 at 16:14
  • @Jeff sure, in this case you could remove the entire OU without any problems – ccellar May 26 '11 at 13:58