Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to track down WHY I can write in a folder that, by my best estimation, I should not be able to write. The folder is shared with "Everyone" has "Full Control", with the files being more restrictive. My best guess is there's some sort of sub-group membership that's allowing me to write, but the nesting of groups that exists in our Active Directory is pretty extensive.

Is there a tool, that will tell me which of the ACL entries allowed or disallowed my writing a file in a folder?

The Effective Permissions dialog is marginally helpful, but what I need is something like a "NTFS ACL Trace Tool", if such a thing exists.

share|improve this question
    
Once you give a large group (like Everyone) permissive settings, smaller groups can only restrict that by using DENY permissions. You could be a member of a group that has few permissions, but unless you specifically DENIED a privilege, your de facto membership in the EVERYONE group will allow you to have access. –  Joel Coehoorn Oct 24 '12 at 16:41
    
I don't quite remember what led me to ask this in the first place. But if I'm right, I think it was something silly like "OurDomain\All Users" were added to the Local "Users" group. something, for some reason group policy wouldn't let me (lowly developer) alter. –  hometoast Oct 24 '12 at 16:55

4 Answers 4

up vote 3 down vote accepted

Try AccessChk from sysinternals:

As a part of ensuring that they've created a secure environment Windows administrators often need to know what kind of accesses specific users or groups have to resources including files, directories, Registry keys, global objects and Windows services. AccessChk quickly answers these questions with an intuitive interface and output.

Pretty sure it will work.

share|improve this answer
1  
This seems to be a (very good) command line version of the Effective Permissions dialog within explorer. This doesn't tell me "why" nor "what set of ACLs matched to allow me access". –  hometoast Mar 12 '12 at 12:42
    
ah. true. I'm not sure what you're looking for exists outside of MS documentation. My best advice would be to try to recreate the environment of the file outside the current structure, then add the permissions one by one, starting with the most restrictive until the file becomes writable. Don't forget sharing and security permissions are different. Good luck. –  Jody Mar 12 '12 at 14:01

You should try using AccessEnum.

enter image description here

This will provide you with the different security principals that have read write and deny entries in the acl for both files and folders. its a free tool too.

After you run the report open it up and look at the unique entries for files and folders in question. and see the effective permissions from there. its fairly manually to do the lookup but by putting in the footwork you can get very specific info.

share|improve this answer

It sounds like you expect Windows to narrow those broad permissions by only checking the most-narrow group. It doesn't work like that. NTFS permissions are determined like this:

  1. Start with no access at all by default.
  2. Build up all allow permissions from all groups into one large set of things you can do.
  3. Take away all deny permissions from all groups (thus, a DENY anywhere will trump everything else).

So if you give the Everyone group full control, and only have allow permissions on your other groups, your de facto membership in the Everyone group will give you full access.

share|improve this answer

If you are setting acls at smb share, then you have to set permissions at filesystem and in share menu. It's probably set to everyone only in share permissions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.