# Active Directory Folder Effective Permissions of all users

I know that is easy to get the effective permissions of one group or user over a folder, but I want to know if it is possible to get the effective permissions for all users on my shared folder. There is any tool to do that?

-
Are you looking for a tool that'll list every person with access and what access they get? –  sysadmin1138 Jan 19 '11 at 21:10
yes, or a windows command if exists –  Santiago Jan 19 '11 at 21:29

The built-in GUI dialog for Security in Explorer will show all explicit and inherited permissions on a file or directory. If a user isn't listed, either by name or by group membership, they have no rights. There's no "effective rights" dialog that I'm aware of, if you're used to and coming from a Netware environment. And you probably wouldn't want a dialog to automatically expand group memberships, since you can have things like "domain users", which would take a while to enumerate in a large domain.

/edit - of course, there's the "effective rights" tab in modern Windows, for a given user or group. Jeez, losing my mind. My point about enumerating "all users" stands - that would take a long time in a large domain, and probably be awful in a large forest.

-
An ugly idea, trying to enumerate the "effective permissions" of a large number of users on even a single resource. Every time I've been asked about reporting on effective permissions for large groups of users I've always found that the issue at the kernel of the request is one of lack of centralized control and design of permission hierarchies. I wouldn't be surprised if that's at play here. –  Evan Anderson Jan 21 '11 at 8:40
Well, my domain is very simple, only 50 users on a single domain controller and the files are on same server, I think that in this case could be faster than one more complex. –  Santiago Jan 22 '11 at 10:42

I think what you are looking for is SetACL. It is very, very powerful and our storage engineers use it to audit shares before migrating them to different boxes. I too have used it and have to say it is pretty useful.

Here is a sample command we use to see all permissions on a share folder. You want to do it on the server itselt.

setacl -ot file -on F:\sharedirectory -actn list -lst "f:tab;w:d;i:n;s:n" -rec cont_obj -log \path\to\logfile.txt

-
Seems good, tomorrow I'll check it, thanks! –  Santiago Jan 19 '11 at 22:18
I don't see how this is going to do what the OP wants. The OP is asking for the effective permissions for users. The command-line you're quoting there is going to dump the ACLs specified on the resource. The effective permissions would be based on mapping the user's group membership to the ACLs specified on the resource (just like the OS does when the user attempts to access the resource). –  Evan Anderson Jan 21 '11 at 8:38

The AccessChk utility from Sysinternals is a command-line tool for viewing the effective permissions on files, registry keys, services, processes, kernel objects, and more.

-