Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm after a way of displaying the particular folders a security group may have access to.

I know I can check individual folders, and compile a list manually, but we have too many for this approach to be practical. There doesn't seem to be an obvious (to me anyway) way of extracting this info from the AD Users and Computers MMC. Perhaps I'm looking in the wrong place?

I've been asked to audit the current access permissions for groups within our AD, so that is the end goal. Some kind of report

I'm coming to grips with AD after migrating from eDirectory, and any ideas would be appreciated.


share|improve this question
up vote 4 down vote accepted

It can't be done the way you want. It just doesn't work that way. The ACLs (Access control lists) are stored on each file and folder. AD doesn't have a clue what folders and files (and servers) the group has been assigned to.

What you can do however, is use the AccessEnum tool from Microsofts Sysinternals. You can run this on a file server, and it will tell you who/what has access to each folder. You can then export this to a CSV for analysis in Excel.

AccessEnum Screenshot

share|improve this answer
Thanks, I had a feeling that may be the case. – LukeR Oct 5 '09 at 20:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.