Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

General problem: By trying to change something in AD, e.g. in the ADUC, I get with a specific user a permission denied (with delegated permissions).

Is there a way to determine, what permission exacly caused the permission denied - like a deny rule that applies. (like lsass -v :)

share|improve this question

Your question isn't exactly clear, but I think what you're looking for is the Effective Permissions tab. You can inspect properties of the object that you're trying to modify. Click on Security. Click on Advanced. Click on Effective Permissions and then select the user that you want to see the permissions for. It will calculate the effective permissions for the selected user on the object that you're looking at.

Effective Permissions

share|improve this answer
Isn't there a log? – Stef Nov 16 '11 at 15:55
@Stef There is, but it's not going to tell you what ACE caused your access denied, AFAIK. You should be able to tell fairly easily what's wrong by inspecting the permissions. – MDMarra Nov 16 '11 at 15:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.