Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

General problem: By trying to change something in AD, e.g. in the ADUC, I get with a specific user a permission denied (with delegated permissions).

Is there a way to determine, what permission exacly caused the permission denied - like a deny rule that applies. (like lsass -v :)

share|improve this question

1 Answer 1

Your question isn't exactly clear, but I think what you're looking for is the Effective Permissions tab. You can inspect properties of the object that you're trying to modify. Click on Security. Click on Advanced. Click on Effective Permissions and then select the user that you want to see the permissions for. It will calculate the effective permissions for the selected user on the object that you're looking at.

Effective Permissions

share|improve this answer
Isn't there a log? –  Stef Nov 16 '11 at 15:55
@Stef There is, but it's not going to tell you what ACE caused your access denied, AFAIK. You should be able to tell fairly easily what's wrong by inspecting the permissions. –  MDMarra Nov 16 '11 at 15:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.