up vote 0 down vote favorite
2
share [g+] share [fb]

I have a user in a domain who has access to multiple subfolders in multiple folders. His rights were defined pretty granularly. Now he's leaving the company but will continue to work for a firm as a contracted resource.

I need to find all folders he had access to and revoke his permissions, then set him up with a different set of access permissions.

Is there any tool (freeware, preferably) that lists all NTFS permissions for a given user? I've tried with AccessEnum from Sysinternals, but the list cannot be filtered by username and is useless for me. I've looked at CACLS, too, but as far as I can tell it displays permissions ordered by file, not by user.

Any ideas?

link|improve this question
100% accept rate
1  
This is why you should always grant membership based on groups, even if there is only one user in the group. You could have just removed him from the group. In the meantime while you wait for an answer, you can just disable his account in AD. – MDMarra Aug 17 '10 at 14:15
Did you try this tool: AccessChk v5.0 ? As a part of ensuring that they've created a secure environment Windows administrators often need to know what kind of accesses specific users or groups have to resources including files, directories, Registry keys, global objects and Windows services. AccessChk quickly answers these questions with an intuitive interface and output. Found here: technet.microsoft.com/en-us/sysinternals/bb664922.aspx – Luke99 Aug 17 '10 at 23:05
@MarkM: So true... It's just that when user needs an access to a single folder, you add him. Then in few months he needs another access on completely different share. And in few months again on 2 or 3 folders. How do you create a group with meaningful name for such user? "Username_granular_access_group"? This would probably do the trick. @Luke99: Interesting tool from Sysinternals. How could I miss it. Anyway, I see it displays all folders user has direct or indirect access to. Is there a way to display only folders where user is explicitly listed in ACL (excluding acces via groups)? – imagodei Aug 18 '10 at 13:20
Bump: I can't believe there isn't any tool out there that could help me with my problem. Surely there is someone who can help me? Thank you. – imagodei Aug 23 '10 at 7:27
feedback

3 Answers

up vote 0 down vote

This can be done with a script in powershell, if you are a scripting guy that is.

Edit: I'm sorry for the short answer. I remember that I've done an easier variant of this but I cant seem to find the script.

I'll keep looking and post it here if I find it. I'm sorry that my post wasnt more useful.

link|improve this answer
1  
+/-0, please elaborate. You could still turn this into a useful answer. – jscott Aug 17 '10 at 11:41
Hello, did you find the script you mentioned? – imagodei Aug 24 '10 at 10:12
Sry, as you might have figured no I didnt. Sry again for the very late response. shame on me – xeet Nov 15 '10 at 19:57
feedback
up vote 0 down vote accepted

I found a solution to my own question. It is, I believe, very simple and clean. Based on the amount of scripting and/or installing, it is also very efective as you only have to install it via Install wizard and then run one line.

You can download subinacl here. Although it is officially supported only on Win2k, XP and 2k3, it should work on Vista, 2008 and 7 as well.

Next, you run the following from the command prompt:

subinacl /testmode /noverbose /outputlog=c:\TEXTFILENAME.TXT /subdirectories=directoriesonly X:\*.* /findsid=DOMAIN\username

Where X: is the drive you're scanning and username is the user whose permissions you'd like to list. Scanning can take some time and you get the results in TEXTFILENAME.TXT.

If you use the switch /noverbose you get a compact list of access permissions - basically you see which directories the user has access to (with access masks and some other stuff that might come in handy sometimes).

I used OpenOffice Calc to import the list and then applied a Custom Filter and filtered only for those lines starting with +FILE. This lines contain directories the user has access to. This is how using simple tools you end up with only relevant information.

Since inheritance is often enabled on parent directories the actual number of directories you might need to visit to adjust permissions is usually significantly lower than the list itself.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.