Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote -1 down vote favorite

I know that is easy to get the effective permissions of one group or user over a folder, but I want to know if it is possible to get the effective permissions for all users on my shared folder. There is any tool to do that?

share|improve this question
Are you looking for a tool that'll list every person with access and what access they get? – sysadmin1138♦ Jan 19 '11 at 21:10
yes, or a windows command if exists – Santiago Jan 19 '11 at 21:29

4 Answers

up vote 1 down vote accepted

The built-in GUI dialog for Security in Explorer will show all explicit and inherited permissions on a file or directory. If a user isn't listed, either by name or by group membership, they have no rights. There's no "effective rights" dialog that I'm aware of, if you're used to and coming from a Netware environment. And you probably wouldn't want a dialog to automatically expand group memberships, since you can have things like "domain users", which would take a while to enumerate in a large domain.

/edit - of course, there's the "effective rights" tab in modern Windows, for a given user or group. Jeez, losing my mind. My point about enumerating "all users" stands - that would take a long time in a large domain, and probably be awful in a large forest.

share|improve this answer
1  
An ugly idea, trying to enumerate the "effective permissions" of a large number of users on even a single resource. Every time I've been asked about reporting on effective permissions for large groups of users I've always found that the issue at the kernel of the request is one of lack of centralized control and design of permission hierarchies. I wouldn't be surprised if that's at play here. – Evan Anderson Jan 21 '11 at 8:40
Well, my domain is very simple, only 50 users on a single domain controller and the files are on same server, I think that in this case could be faster than one more complex. – Santiago Jan 22 '11 at 10:42
up vote 1 down vote

I think what you are looking for is SetACL. It is very, very powerful and our storage engineers use it to audit shares before migrating them to different boxes. I too have used it and have to say it is pretty useful.

Here is a sample command we use to see all permissions on a share folder. You want to do it on the server itselt.

setacl -ot file -on F:\sharedirectory -actn list -lst "f:tab;w:d;i:n;s:n" -rec cont_obj -log \path\to\logfile.txt

share|improve this answer
Seems good, tomorrow I'll check it, thanks! – Santiago Jan 19 '11 at 22:18
1  
I don't see how this is going to do what the OP wants. The OP is asking for the effective permissions for users. The command-line you're quoting there is going to dump the ACLs specified on the resource. The effective permissions would be based on mapping the user's group membership to the ACLs specified on the resource (just like the OS does when the user attempts to access the resource). – Evan Anderson Jan 21 '11 at 8:38
up vote 1 down vote

The AccessChk utility from Sysinternals is a command-line tool for viewing the effective permissions on files, registry keys, services, processes, kernel objects, and more.

share|improve this answer
up vote 0 down vote

is there such a thing as an "Active Directory Folder"? I think you mean a windows folder - or an Active Directory OU or Container? If you mean Windows folders, I used to use TreeSize which is mostly for calculating the space of subfolders of directories but also has a security tab which will show all the effective permissions assigned to folders, subfolders and files.

http://www.jam-software.com/treesize/

Very useful utility with a decent GUI but you can script probably all of what it does on your own if you have the time.

share|improve this answer
He does explain by saying "shared folder" in his question text, so I would only read that as a directory on a filesystem that has been shared. – mfinni Jan 19 '11 at 21:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.