up vote -1 down vote favorite
share [g+] share [fb]

Is it possible to list all folders/files that a given group has explicit permissions on, for a machine running Windows Server 2003? If so, how? It would be nice to see inherited permissions as well, but I could do with just explicit permissions.

A little background: I'm trying to update groups/permissions on a test server. One of the groups, Devs, wasn't implemented correctly when it was created, and my goal is to remove it from the system. It has been replaced by LeadDevelopers, which has permissions on many — but naturally not all — of the same folders. I want to make sure that I don't accidentally orphan any folders or cause any other issues when I remove Devs. It did have some admin-level permissions.

EDIT: The answers so far — at least *cacls and AccessEnum — provide a way to find out which groups/users have permissions on known directories/files. I actually want the reverse of this behavior: I know the group, and I'm looking for the directories/files for which the group has permissions. Also, as I noted in a comment, the Devs group is not itself a member of any other group.

link|improve this question
81% accept rate
feedback

3 Answers

up vote 1 down vote

Sysinternals' AccessEnum might help do what you want. It will enumerate the permissions on your directories. It doesn't exactly show whether the permissions are explicit or inherited, but it will show you all directories (and files) whose permissions differ from their parent. This probably gets you the same information. It can also enumerate permissions registry keys in the same manner.

You might also be interested in AccessChk (command line) and ShareEnum (like AccessEnum for your file shares).

link|improve this answer
AccessEnum is probably your best bet (=1), but is still not a silver bullet, unfortunately. For your specific scenario it should help as it will highlight exceptions to the normal inhertiance, where Devs may have been given explicit permissions. Hopefully you are also taking into account nested group membership, so if Devs is a member of AllGeeks, you need to make sure LeadDevs is also in there or is given permissions at the same places as AllGeeks – AdamV May 28 '10 at 7:47
@AdamV, fortunately, I know neither Devs nor LeadDevelopers is a member of another group, but it's definitely a good point to keep in mind. – Lord Torgamus May 28 '10 at 14:11
feedback
up vote 1 down vote accepted

Looks like there is no simple tool for this. I ended up going with a combination of getting a report from DumpSec and searching for Devs with FINDSTR.

And yes, I know there are dozens of equally good solutions, but those were the tools I was thinking of when I decided to give up the search for a one-step strategy.

link|improve this answer
feedback
up vote 0 down vote

Try cacls.exe or xcacls.exe or icacls.exe or even SetACL. These will not only will list the permissions, including inheritance, but will allow you to edit or replace them.

The cacls/xcalcs and icacls aren't great for displaying permissions for a particular user or group but SetACL seems to have that functionality but has a complex though powerful syntax.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.