Tools, recommendations to understand NTFS permissions?

Question

I'm trying to troubleshoot some issues with our IIS7 FTP site--namely, why some users have access to the site when it doesn't look like they should. The basic problem is that I do not understand NTFS / Active Directory permissions very well.

Does anyone know if any tools exist that allow you to view where permissions are coming from? For example, if I have read access to a particular folder, what is the source of that permission? I know the basics such as group membership and inherited permissions, but I'm running into situations where a user does not appear to be part of any group that has permissions to a resource, and yet is able to access that resource nonetheless. Clearly I lack an understanding of how/what permissions are inherited, what overrides what, etc.

In addition to tools that might help analyze/learn about permissions, I would welcome suggestions on the best way to get a thorough understanding of permissions. Favorite books, articles, etc. Thanks!

Answer 1

One tool that I find useful to see the state of permissions for a heircarchy is the sysinernals tool AccessEnum. It does not show you the permissions, instead it scans a folder and shows you who has read, write, or been denied access.

Past that, go to a command line and use the icacls command to examine a folder or files.

Answer 2

NTFS permissions are hierarchical by nature. Any file/folder inherits permissions from the parent folder. You can append permissions to & from, or start a new "root" by blocking inheritance. Finding where permissions come from... is as simple as looking where the file is at... and what is above it.

Similarly user permissions are also hierarchical... If I'm in a group... who is in another group... who is in a group who has sufficient privileges to access the folder... that means I do too. By default, every user must be in at least 1 group, and 99% of the time they're in the "Users" group, or "Domain Users" (if you're in a domain).