Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For a Windows domain, is there a way to see for a certain user or group, where the user/group has permissions?

Primarily: List which files / folders the user can access on a certain network share. (Kind of a recursive "effective permissions") However, other permissions would be cool as well.

I believe I've seen such a tool in action, but I can't remember anything beyond that - so this might be a false memory.


share|improve this question
up vote 2 down vote accepted

Windows Sysinternals has a tool AccessEnum which states: "While the flexible security model employed by Windows NT-based systems allows full control over security and file permissions, managing permissions so that users have appropriate access to files, directories and Registry keys can be difficult. There's no built-in way to quickly view user accesses to a tree of directories or keys. AccessEnum gives you a full view of your file system and Registry security settings in seconds, making it the ideal tool for helping you for security holes and lock down permissions where necessary." Good Luck!

share|improve this answer

The net user command might be what you are locking for. The syntax is as follows:

net user` /domain [username]

Sample Return:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>net user /domain joneswac
The request will be processed at a domain controller for domain MY.SCHOOL.EDU.

User name                    joneswac
Full Name                    Wesley P Jones
User's comment
Country code                 000 (System Default)
Account active               Yes
Account expires              Never

Password last set            5/6/2013 3:51:33 PM
Password expires             Never
Password changeable          5/6/2013 3:51:33 PM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory               \\WONDERFULSCHOOL\students\joneswac
Last logon                   6/1/2013 3:31:50 PM

Logon hours allowed          All

Local Group Memberships
Global Group memberships     *SOCIAL AND BEHAVIORAL*IT Boot Camp Admin
                             *Students             *Registered for Classe
                             *Domain Users         *90B SOC SCI TCH PLAN
The command completed successfully.

share|improve this answer

view all login user group (nested too):

DSQUERY USER -name %Username% | DSGET USER -memberof -expand | DSGET GROUP -sid -samid | more

view all user group (nested too):

DSQUERY USER -name <user name> | DSGET USER -memberof -expand | DSGET GROUP -sid -samid | more

view all memberof group (nested too):

DSQUERY GROUP -name "Nected Group Set of resources 1" | DSGET GROUP -memberof -expand | DSGET GROUP -sid -samid

view all members group (nested too):

DSQUERY GROUP -name "Nected Group Set of resources 1" | DSGET GROUP -members -expand | DSGET GROUP -sid -samid

view curent user permission, see too /Z /V ... /R options:

GPRESULT /USER %username%

view curent user prop:

dsquery *  -filter "(samAccountName=%username%)" -attr *


PDF! : Effective Permissions

share|improve this answer
The PDF! : Effective Permissions link is broken. – Kjell Rilbe Dec 8 '15 at 5:18

the best recommendation in my mind is DREP, a very powerful system that allows you to to check and track the real file system permissions. You can switch your point of view to signle user (even on multiple configured file server) or to single file/folder.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .