Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Executive summary: I want to find all the directories and files a particular user or group has access to.

In more detail: I'm looking for a command-line tool to recursively search an NTFS directory for all files and directories where an ACE in the DACL contains a given user or group. If I wanted to modify permissions, I would use subinacl or SetACL. I thought I would be able to use one of these tools to search and display, too, but I'm having trouble finding a straight-forward solution.

I could use SetACL like so:

   setacl -on C:\SOME_DIR -ot file -actn list -lst "f:tab;w:d;i:y;" -rec cont

and then grep for the user of interest, but I'd like a more elegant solution. I'm probably missing something here. Any ideas?

share|improve this question
1  
You're probably not going to find an elegant solution since it's such an inelegant problem. I would've recommended SetACL, so you're already where I'd recommend you being. (I once had somebody ask me to write a tool to audit and "report" on file permissions on a 6TB 10,000,000+ file shared folder hierarchy. I pointed them at SetACL and said "Good luck-- I wouldn't touch that w/ a 10 foot pole.") –  Evan Anderson Sep 3 '09 at 23:25
add comment

4 Answers

Here is a powershell script I modifed from above that worked for me:

$files = @()
Get-ChildItem "d:\some\path" -recurse | 
    ForEach-Object { 
        $fname = $_.FullName
        if ($fname -notlike "*_vti*") {
            $acl = Get-Acl $($fname)
            foreach ($e in $acl.Access) {
                If ( $e.FileSystemRights -like "*Modify*" -and 
                     $e.IdentityReference -eq "domain\user") 
                {
                    $files += $fname
                    break
                }
            }
        }
    }
$files > d:\out.txt
share|improve this answer
add comment
up vote 3 down vote accepted

Thanks, "unknown". Your PowerShell script doesn't work for me, but I hacked together something that does. I'm new to it, too, but after some trial and error:

Get-ChildItem "C:\SOME\DIR" -recurse | 
    ForEach-Object { 
        $fname = $_.FullName
        $acl = Get-Acl $fname
        foreach ($e in $acl.Access) {
            If ( -not $e.IsInherited -and
                 $e.AccessControlType -eq "Allow" -and 
                 $e.IdentityReference -eq "SOMEDOMAIN\Somegroup") 
            {
                Write-Host $fname
                break
            }
        }
    }

Somebody with PowerShell kungfu could probably clean this up a bit. Note that I have it ignore inherited entries, because I'm only interested in knowing where the access begins.

share|improve this answer
    
Finally getting back to this. So that's not a bad solution, but the problem I run into is that it fails for filenames containing wildcard characters, e.g.: Get-Acl : The specified wildcard pattern is not valid: foo[bar.txt I've tried escaping $fname before I use it in the call to Get-Acl, but so far (using "-replace '[[]]', '``$0'", for example) without success. –  David Aug 13 '10 at 18:54
add comment

Untested, and a little new to powershell, but something like this would write it to screen. From there you could dump it to a file or whatever.

Get-ChildItem "RootFolderPath" -recurse | 
    ForEach-Object { 
    	$acl = Get-Acl $_.FullName
    	If $acl.ContainsKey "User/Group" {Write-Host $_.FullName}
    }
share|improve this answer
    
Will this work if you don't have access to some of the files as administrator? –  Zoredache Sep 3 '09 at 21:29
    
Nope. PS is going to use whatever credientials you run it with, and if that account doesnt have the correct permissions on the file/folder then it won't be able to read the permissions/acl from the file/folder. –  user10711 Sep 3 '09 at 21:33
1  
Nothing will work in that scenario. The account which runs it will need at least Read Permissions rights and Traverse Folder access on the folders you're recursing through. –  squillman Sep 3 '09 at 21:37
    
@squillman: You might be able to do it with "Backup Operators" rights, the BackupFile APIs, and a strong enough will to parse opaqua binary data streams. >smile< That aside, I agree with you. –  Evan Anderson Sep 3 '09 at 23:23
add comment

Would accessenum work for your use-case, I wonder?

share|improve this answer
    
The problem there is that it looks like you can't filter for a specific user or group. –  David Sep 4 '09 at 19:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.