Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.


I recently inherited an environment with very poor file permissions setup with no documentation as to who has access to what. For example I found that a directory called HR confidential was open to everyone. I am aware that you can setup some pretty neat things with Sharepoint workflows and wanted to know how others handle these things. To give you an idea of our size we are about 150 users. I don't know Sharepoint that much yet but I am getting the feeling that I should be learning it soon.



Sorry everyone for the confusion. Right now I need to clean up the windows file permissions. ShareEnum is the tool for that. Once I understand who needs access to what I want to have the access to the file shares documented and approved via a Sharepoint workflow.

share|improve this question
I'm confused. Is your problem with file\folder permissions or with Sharepoint? Also, how are Sharepoint workflows going to help you analyze and implement better file system security? –  joeqwerty Jul 2 '10 at 11:23

2 Answers 2

up vote 1 down vote accepted

To see where you're at, take a look at SysInternal's ShareEnum utility: it'll crawl the network looking for shares and show you the permissions for each.

I agree with Robert Kaucher's post re: meeting with the department heads to understand the permissions requirements: you want that stuff documented anyways because if somebody gets a hold of something they shouldn't, who do you think they're going to blame?

share|improve this answer

I agree that SharePoint is a great tool for organizing and storing documents but it isn't really going to address the issue at hand. What I would suggest you do is meet with the managers of each department and find out what their business critical shares are and who should have permissions to said shares and what sort of permissions they should have.

Once that is done you can write a very simple PowerShell script that will scan the file system and tell you which users and groups are assigned which permissions to the shares. This script should then query active directory to tell you who belongs to the groups. One issue that I have seen from a DBA perspective is that AD admins might add people to AD groups used to access both file shares and tables in a SQL database (through group nesting). While they may be allowed to access the file shares their access to the DB is not ok. So Bill might have been added to the Dom_Loc_Engineering group so he has access to certain CAD files but the Dom_Loc_Engineering group also has access to a folder containing specs for military contracts that Bill should never be allowed to see.

The only advantage of migrating to SharePoint from the perspective of file/folder permissions would be that you are starting from scratch and can assing permissions properly. Workflows will not help you in this area although the "request access" option in SharePoint might be useful to users once permissions are properly restricted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.