Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The cacls command in Windows XP and Vista can be used to deny read access to files to certain users. How can I find out which files in a directory tree are readable for a user after cacls has been run? A batch file solution is preferable.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

You want the excellent Sysinternals command-line tool AccessChk.

I created an example folder C:\test and populated it with two files, normal.txt and secure.txt. The latter file was set to be permissioned only to my account whereas normal.txt has the default inherited permissions.

The command I then used was accesschk -r -s Gareth C:\test (display all the files in the folder test and below that the user Gareth has read-only access to). Here's the output:

Accesschk v5.01 - Reports effective permissions for securable objects
Copyright (C) 2006-2010 Mark Russinovich
Sysinternals - www.sysinternals.com

RW C:\test\normal.txt
RW C:\test\secure.txt

I then ran it with another user: accesschk -r -s AnotherUser C:\test - here's the output:

Accesschk v5.01 - Reports effective permissions for securable objects
Copyright (C) 2006-2010 Mark Russinovich
Sysinternals - www.sysinternals.com

RW C:\test\normal.txt

Hopefully that does the job!

share|improve this answer
1  
only problem is that files as this command lists files which do have have read permissions, I get access denied errors. But I can grep for "Access denied" from the output and filter these out. –  arun Mar 30 '11 at 6:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.