On the Effective Permissions window in Windows Explorer you can enter a user or group name and see what permissions that user or group would have over that particular file.

I'm slightly confused about the highlighted text:

Effective Permissions

"...based solely on the permissions granted directly through group membership"

In the example, the user in question does not get any permissions by membership of a group - all the permissions entries are defined for the user only. However, the permissions shown are correct.

The wording suggests that the window only shows permissions granted to a group of which the user is a member, but that can't be correct because that user only gets permissions specifically granted to them, not by group membership. So what does this text mean?


the Windows Server documentation states that the Effective Permission feature on Windows Explorer provides only an approximation of the real effective permissions that apply to a user. You can read here or googling about the boring same words... Windows Explorer does not resolve an entire permissions chain on a file system object, in case of nested AD groups or cross-domain (or subdomain) accounts Windows Explorer does not show to you the real permissions. To verify the entire permissions chain, based on real permissions on file system, you need to use a external tool or system like AccessChk or Niu Lang (sorry for the link: my reputation is too low).

  • 1
    My final choice is Data Rover EP by Mission2Mars. You can download a free virtual appliance here: link – Gizeh Jun 10 '14 at 10:48

The help for the Effective Permission tab says, " If you want to find out what permissions a user or group has on an object, you can use the Effective Permissions Tool."

So this is a tool to test your security to see if it is working, and how. When you set up permissions you are eventually looking outwards at the perimeter fence around your yard. When you are looking at effective permissions, you are looking back inwards from the outside world to see which doors are open to a particular person (or group).

Start by clicking on 'select' to the right of "Group or user name:" which gives this dialog box:

enter image description here

Click "Object types..." and check only "Users" for now. Then click ok.

Then click "Locations..." and select a location this user has access to. On my system I only have one computer to select from. But if you had access privileges on other machines they would show up here. Make a location (host) selection and click ok.

Now to help you see how the next box works, click the "advanced button". You will see a list of all users who have any access to this resource on this machine that you have selected. Select one of the less privileged users, like guest and click ok.

Now notice that you can type in this as well under, "Enter the object name to select", and you can also enter several machine\user choices (at the same time) here.

Click ok to return to the Effective Permissions tab with your new selections. I selected Love2/Guest and this shows that Guest has no effective permission on my machine, which is correct, as it sure better not have any permission as I have not granted any permission to guests. enter image description here

Now go back and select a different machine/user pair, like your primary account for example on your machine. Now when I click OK to return to the effective permission tab, I can see that I have full control of all permissions. Remember this is for the file or folder that I inquired about when I started this whole process. In my example this is the folder: "Milwaukee shear blades".

enter image description here

Hope this helps you understand what this tab is for.

  • 1
    That's a decent enough explanation of how the Effective Permissions tool works, but it doesn't answer the question. I'm only looking for an explanation of the cofusing (to me) text: "...based solely on the permissions granted directly through group membership" – toryan Jan 18 '14 at 0:52
  • I agree with you that it's hard to understand and confusing. That's why I think looking at how it actually works, helps understand this phrase you are asking about. "A group" is in mathematical terms "a set". And a set can contain zero, one, or more elements. This tool allows you to specify any grouping and then view that group's effective permissions. Normally the permission might be thought of as of those of all elements of the set, but this tool allows specific memberships to be specified, and thus "solely" thru the group membership. Anyway it was unclear to me at first and now I see it. – Elliptical view Jan 18 '14 at 2:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.