Sign in
Microsoft.com
 
Microsoft
 
 
 

locked
Multiple PrivUser/PrivReporting/SQLAccess Groups RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    Need some advice regarding multiple groups related to CRM 2011.

    Our environment consists of 1 x CRM 2011 server (on premise) and 1 x SQL 2008 R2 server.

    While troubleshooting the Email Router (which is now working fine) I found in AD multiple of the following groups:

    PrivReportingGroup - 5 of them

    PrivUserGroup - 5 of them

    ReportingGroup - 5 of them

    SQLAccessGroup - 5 of them


    I believe that 4 out of the 5 are from previous installations and re-installation of Dynamics CRM 2011.

    I found this Technet Article: http://technet.microsoft.com/en-us/library/hh699751.aspx , ran the query:

    select id, friendlyname from organization

    but received a GUID which does not match any of the groups above.

    I am almost certain I know which of the 5 groups is my actual deployment GUID, but am not 100% sure. (I added users to that group and it resolved the email router issue I had...)

    How can I find which of the 5 GUID is the correct one? Can I asume the other GUID are from previous installations? Are they safe to delete from AD?

    Any help will be appreciated.

    Y.

    Wednesday, October 17, 2012 3:00 AM

Answers

  • Question
    Sign in to vote
    1
    Sign in to vote

    I believe that 4 out of the 5 are from previous installations and re-installation of Dynamics CRM 2011.

    Very likely.

    I found this Technet Article: http://technet.microsoft.com/en-us/library/hh699751.aspx , ran the query:

    select id, friendlyname from organization

    but received a GUID which does not match any of the groups above.

    The GUID specified in the Active Directory groups for your current deployment will match the GUID identifier for the 1st Organisation created in that deployment.  Often this is merely a temporary organisation created as part of the installation of CRM, which may be why you can find no trace of it any longer.

    How can I find which of the 5 GUID is the correct one? Can I asume the other GUID are from previous installations? Are they safe to delete from AD?

    Run the following query against any of the Organisation DBs (i.e. <orgname>_MSCRM):

    select PrivReportingGroupName, ReportingGroupName, SqlAccessGroupName from Organization;

    It will display the names of the corresponding Active Directory groups.

    --pogo (pat) @ pogo69.wordpress.com

    Wednesday, October 17, 2012 4:08 AM

All replies

  • Question
    Sign in to vote
    1
    Sign in to vote

    I believe that 4 out of the 5 are from previous installations and re-installation of Dynamics CRM 2011.

    Very likely.

    I found this Technet Article: http://technet.microsoft.com/en-us/library/hh699751.aspx , ran the query:

    select id, friendlyname from organization

    but received a GUID which does not match any of the groups above.

    The GUID specified in the Active Directory groups for your current deployment will match the GUID identifier for the 1st Organisation created in that deployment.  Often this is merely a temporary organisation created as part of the installation of CRM, which may be why you can find no trace of it any longer.

    How can I find which of the 5 GUID is the correct one? Can I asume the other GUID are from previous installations? Are they safe to delete from AD?

    Run the following query against any of the Organisation DBs (i.e. <orgname>_MSCRM):

    select PrivReportingGroupName, ReportingGroupName, SqlAccessGroupName from Organization;

    It will display the names of the corresponding Active Directory groups.

    --pogo (pat) @ pogo69.wordpress.com

    Wednesday, October 17, 2012 4:08 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    How can I find which of the 5 GUID is the correct one? Can I asume the other GUID are from previous installations? Are they safe to delete from AD?

    Run the following query against any of the Organisation DBs (i.e. <orgname>_MSCRM):

    select PrivReportingGroupName, ReportingGroupName, SqlAccessGroupName from Organization;

    It will display the names of the corresponding Active Directory groups.

    --pogo (pat) @ pogo69.wordpress.com

    Brilliant! Thank you! It confirmed the GUID I thought was the correct one.

    Can I now delete all the groups with the different GUID's? What will be the consequences if I delete?

    Thanks for the superfast response!

    :-)


    • Edited by yud_ Wednesday, October 17, 2012 6:04 AM
    Wednesday, October 17, 2012 4:19 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Sorry for the bump but I would really appreciate an answer:

    Provided I only have 1 Org, is it safe to delete from AD all the groups with the other GUID's?

    Presumably the other groups are from previous installation/reinstallations we have done in the past prior to the production deployment.

    Friday, October 19, 2012 2:16 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    The other groups should not be in use, so you should be able to delete them.

    However, it is possible that someone granted rights directly to these groups in AD or SQL. Unfortunately I don't think there is an easy way to find out if this is the case

    Microsoft CRM MVP - http://mscrmuk.blogspot.com/ http://www.excitation.co.uk

    Friday, October 19, 2012 12:05 PM
    Moderator
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    Please go to the Management Studio, choose the MSCRM_CONFIG database, drill down to Security, Users, and there you have the PrivReportingGRoup,and the SQLAccessGroup users, there you can check the ids. If you do the same to the XXXXXX_MSCRM, you can check the users ids in there.

    Kind Regards,

    Pedro Airo

    Wednesday, October 24, 2012 8:11 AM