1

I'm putting together a quarterly audit script and I'm trying to provide information to data owners about the groups they administer. The most difficult aspect of this operation is determining to which folders a particularly Active Directory group has access. Because I'm inheriting the schema, I have no way of knowing which groups have access to which folders.

Is there an alternative to AccessEnum that will allow me to specify the recursion depth, or some other tool which will allow me to capture this information without scanning every file on the DFS?

Improve this question
2
  • What sort of script? Can it be Powershell?
    – Sam Cogan
    Jan 13, 2012 at 8:20
  • Absolutely -- the script I'm writing now (for SOX, if that matters), is in PowerShell.
    – Chad_C
    Jan 13, 2012 at 13:48

1 Answer 1

Reset to default
0

Unfortunately the ACL is tied to a folder, rather than a group, so there is no real way to determine what folder a group has access to, without checking every folder. AccessEnum is the best way I know how to do this (I had thought I had seen a PS script that worked better but can't find it now).

If it makes things easier you could use AccessEnum to export permissions for all folders to a csv or similar and then parse this CSV for your groups, rather than using AccessEnum everytime.

Improve this answer
1
  • Sam, Thanks for the reply -- I understand how AccessEnum works, and how the ACL/Security Group link in NTFS is just out of control, but I was wondering about a way to modify the depth at which AccessEnum processes folders. Because of the DFS design, I know that security groups are used for a maximum of 4 depths from the root DFS folder (call it O:). What I would like to do is halt AccessEnum from analyzing every single child file/folder.
    – Chad_C
    Jan 18, 2012 at 2:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .