Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm putting together a quarterly audit script and I'm trying to provide information to data owners about the groups they administer. The most difficult aspect of this operation is determining to which folders a particularly Active Directory group has access. Because I'm inheriting the schema, I have no way of knowing which groups have access to which folders.

Is there an alternative to AccessEnum that will allow me to specify the recursion depth, or some other tool which will allow me to capture this information without scanning every file on the DFS?

share|improve this question
What sort of script? Can it be Powershell? – Sam Jan 13 '12 at 8:20
Absolutely -- the script I'm writing now (for SOX, if that matters), is in PowerShell. – Chad_C Jan 13 '12 at 13:48

Unfortunately the ACL is tied to a folder, rather than a group, so there is no real way to determine what folder a group has access to, without checking every folder. AccessEnum is the best way I know how to do this (I had thought I had seen a PS script that worked better but can't find it now).

If it makes things easier you could use AccessEnum to export permissions for all folders to a csv or similar and then parse this CSV for your groups, rather than using AccessEnum everytime.

share|improve this answer
Sam, Thanks for the reply -- I understand how AccessEnum works, and how the ACL/Security Group link in NTFS is just out of control, but I was wondering about a way to modify the depth at which AccessEnum processes folders. Because of the DFS design, I know that security groups are used for a maximum of 4 depths from the root DFS folder (call it O:). What I would like to do is halt AccessEnum from analyzing every single child file/folder. – Chad_C Jan 18 '12 at 2:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.