is there a good tool for viewing the permissions in AD?

Question

I want to be able to see a nice picture of nested groups in AD. Are there any products that do that for me?

Answer 1

I created a HTA script which displays the nested groups in a GUI. I hope this helps.

You can download it at: http://zeda.nl/t03

Answer 2

I am not sure if this is what you are looking for, but my application SetACL Studio has a very nice user interface and is designed to replace the built-in Windows ACL Editor.

It displays permissions on files and folders, registry keys, network shares, printers, services and WMI objects. Changing permissions and ownership is easily possible, too, of course.

Answer 3

If you are on a windows machine, you can use the dsget group command with -members -expand to expand the groups with membership via nesting. I'm not sure if this is what you want, but I hope it helps in some way, if you have not already found a more elegant solution. As a warning, this code is off the top of my head, as I no longer have access to a Windows machine:

$all_members = []
$nested_groups = []

dsquery group -limit 0 | ?{$_ -imatch "cn=$your_groupname,"} | dsget group -members -expand | % {
    # these are all the members of the group, including those groups with
    # membership via nesting

    # you could omit the users by extracting the group name from $_
    # and testing that they are a group

    $possible_group = $_

    if ( $possible_group -imatch "cn=([^,]+)," ) {
        $possible_group_name = $matches[1]
        $all_members += $possible_group_name

        # this condition may or may not work.  if not, get sample output
        # from calling dsquery group on a user and use that as the condition
        # instead

        if ( dsquery group -name $possible_group_name -ne $null ) {

            # alternatively, you could make each member of $nested_groups
            # an array, make this a function, and recursively collect
            # the entire nesting of this and all sub-groups

            $nested_groups += $possible_group_name
        }
    }
}

write-host "groups in $your_groupname, via nesting"

$nested_groups | % {
    write-host "`t$_"
}

Write-host "groups and users in $your_groupname, via nesting"

$all_members |  % {
    write-host "`t$_" 
}

I hope the code works for you, and if not, there is probably a small typo from bad memory on my part.

Good luck! :)