Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need a tool/script that will report currently defined permissions for a given path.

  • If the permissions for a subtree are the same as for its parent, the whole subtree should be omitted.
  • Files should only be listed if the permissions are different from its containing directory.
  • Output should be compact (unlike cacls/icacls) and in plain text so I can commit it to SVN.

Does something like this exist?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

It sounds as if this may do what you're after. It's not powershell code, but I do love sysinternals toys.

share|improve this answer

The setacl utility will do what you're looking for, with the added benefit of having an option to "restore" ACLs saved in a file to a live filesystem. I've used setacl in a manner similar to what you're describing, including "restoring" ACLs as part of the script automatically to checkout and deploy the application from version control.

The command-line syntax for setacl is, arguably, confusing and difficult. To save the ACLs from a folder hierarchy into a file you'd be doing:

SetACL.exe -on "\\server\share\source-folder" -ot file -actn list -lst "f:sddl;w:d,s,o,g" -rec cont -bckp "output-file.txt"

Objects (files or folders) that are inheriting all their ACLs from their parent object won't be listed in the output (so such that only objects that have ACLs set on them will be reported).

share|improve this answer
    
Thanks, I tried some formatting options but I couldn't get the output to be 'human readable'. –  hcris Jul 30 '10 at 8:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.