Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So we took over a new client and their file server is frankly a mess.

We have migrated their old file server from a 2k box to a 2k8 DFS cluster and now I'm looking at rebuilding both the folder structure and their permissions. Unfortunately its been half done with AD groups (poorly named/no description/notes) and half with individuals named in security on the folders themselves.

What I'm looking to do is to dump a complete list of all the folders with their security permissions (ideally I'd like to ignore files but not essential).

CACLS got me half way there but fails with an odd error message and its output isn't particularly user friendly and I'm working with roughly 2Tb/250,000 files here so I really need something that gives me a bit more functionality.

Question : does anyone have any experience of something similar/know of a bit of software that might help me out?

share|improve this question
Fails with what error message? Telling us it's "odd" doesn't exactly provide us with useful information which might allow us to help you out. – John Gardeniers Jan 17 '11 at 20:47
Yes - sorry about that. I didnt have the error to hand. I did get half the output from CACLS before it failed and looking at it I wasn't inspired to continue down that route, I'm not asking to resolve that issue but looking for an alternative. – Patrick Jan 18 '11 at 12:41
you need to keep in mind that users do this sort of thing ("there was some kine of error message") to us all the time, so many of us have developed a low tolerance for it. ;) – John Gardeniers Jan 18 '11 at 20:23
Yes, Understood. 'I clicked OK on this error message a few times and now its broken.' I'll avoid this in the future :) – Patrick Jan 19 '11 at 8:58
up vote 1 down vote accepted

you have several options. But first I would suggest you maybe make your life easier by using xcopy to only copy the directories and their respective ACL/Auditing settings.

you might be able to continue with cacls or use something else...

  1. AccessEnum from Sysinternals
  2. PowerShell may have some possibilites. This LINK may help (corrected).
  3. Python calling on Win32 API. I haven't tested this LINK, but have a look...

All that, but why not do the human part and sit down with people and ask who needs access to what? Then create a new structure and permissions based on the needs using your conventions and documentation.

share|improve this answer
In regards to point 3, don't you mean ANY language calling the Win32 API? Why would you specify a single language, especially one so little used on Windows? – John Gardeniers Jan 17 '11 at 20:45
AccessEnum looks like it might do the business, I'm testing it out now. As for your final point, unfortunately sitting down with the business isn't as straight forward as it might appear. We're talking about a large national company here, about 1000 users spread across a large number of small sites. I have actually already moved a few departments into a new folder structure but trying to unpick the rest of the file system is proving to be a bit of a nightmare. – Patrick Jan 18 '11 at 12:46
@John, good point, I did not mean to single out a language. It just happens to be my prefered language. I've found it to allow me certain freedoms that other languages do not as a Windows admin. – cwheeler33 Jan 18 '11 at 19:49
@Patrick, in your situation it's clearly impractical to discuss permissions with all the users but perhaps you should still talk to department heads, who can then talk to their staff. – John Gardeniers Jan 18 '11 at 20:21
@John. We've agreed a new folder structure with the business and some data as been successfully ported to it. The major problem I have is that there are a load of folders that are entirely unstructured and uncontrolled. 'Everybody' had full control and therefore the permissions are all over the place. The IT Dept we have taken over from appear to have had no policy for structuring file servers or any kind of naming convention for the AD groups that they have made. The whole thing is a mess. You should have see how the VPN was setup! – Patrick Jan 19 '11 at 8:56

A number of years ago I created a system for my own use that was designed to save and recreate share based permissions. i.e. It will recreate shares and the permission son those share, plus any lower down permissions that differ from the share itself.

The only case I can think of where it might not do what you want to do is on a Terminal Server, where the permissions are not necessarily below a share. Although it has never been tested on 2008 I see no reason it shouldn't work on that version as well.

You can download it from here and you are free to use it without restriction. Be sure to read the ReadMe.txt before using it. It was created to be effective, not elegant.

share|improve this answer
I've just got back to the server that I ran this on as test and, although it looks extremely useful if I need to move shares, the output in the .perms files isn't anything like as useful as that from the AccessEnum. I'll keep hold of it though as I've had problems with moving shares before and that looks extremely useful. Thanks. – Patrick Jan 18 '11 at 15:22
@Patrick, the perms files are certainly not very useful on their own, as well as being hard to read, but once you run DriveAdjust.exe the resulting batch file might be more useful. – John Gardeniers Jan 18 '11 at 20:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.