Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The question: I'm looking for a good way to audit/search a directory structure (Windows 2003) and locate any folders that either don't inherit permissions from their parent -or- have additional users/groups added.

The Back Story

We're migrating an old Windows 2003 file server to a 2008 R2 box. This old server was migrated from NT4. Most of the current folders use the old (deprecated?) Domain\Administrators and Domain\Users groups. These are groups that, while still in AD, I can't use for permissions in 2008 R2 permissions.

So, before I robocopy over all the shared data from old server to new I first need to "modernize" the permissions on the old shares. However, I know that over the past decades some [undocumented] folders have had their permissions modified to either not inherit from parent or to add additional users. Thus my quest for a way to find 'em!

share|improve this question
up vote 7 down vote accepted

I would recommend to use Powershell (for Win2003: and a additional add-on module also for this ( ).

This will help you first to get the inheritance for a folder structure with (when running from your startfolder) eg.

get-childitem -Recurse | get-inheritance | export-CSV C:\Inheritance.csv -NoTypeInformation

You will get all files and folders in a csv which can then be filter in Excel or other DBs if you need.

Additional benefit of the NTFSSecurity Modul is that you can change the inheritance or the ACLs also during migration with a similar Powershell script.

e.g. you can completly remove inheritance in a folder (your start folder) with:

get-childitem | Disable-Inheritance

or add the -recurse switch again for all subfolders / files again.

Hope this help Cheers

share|improve this answer
+1 for making me aware of the File System Security PowerShell Module. – pk. Apr 19 '12 at 13:37
Small, but extremely functional and useful! A must-have thing! – Volodymyr M. Dec 16 '15 at 8:23

This is pretty easy with SetACL. Run it like this:

SetACL -on "some path" -ot file -actn list -lst f:csv -rec cont

That command instructs SetACL to print permissions from those objects only that have explicit permissions, either because ACEs were added to a directory with inheritance enabled or because inheritance was disabled and new ACEs were set.

SetACL processes paths longer than 260 characters and lists ACEs from any directory regardless of current permissions, i.e. even if you do not even have read access SetACL shows you what is there and prints the permissions (admin rights required).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.