Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any software that can scan through an NTFS file system and generate an easy to read report of NTFS permissions?

share|improve this question
add comment

6 Answers

XCACLS.vbs will give you the NTFS permissions, in yet another super ugly format. Also, it is extra slow.

Upside, you redirect it into a file, let it run overnight(s), and end up with a whole crapload of text that you can parse with Python, or your language of choice, to produce something useful.

share|improve this answer
add comment

The Microsoft utilities all have known issues handling permissions correctly or performance issues.

Use fileacl.exe [folder] /files /sub > output.txt

http://www.gbordier.com/gbtools/fileacl.asp

share|improve this answer
add comment

You should try SetACL. It has three different ways of listing permissing: tabular output (easy to read), CSV and SDDL (the latter two are easier to consume by scripts). John Gardeniers probably did not know about that. It also is very fast - and free.

Given admin rights SetACL can list the permissions of every file and folder on the drive regardless of permissions. It also works with paths longer than 260 characters.

Here is an example, listing permissions recursively for every file and folder on drive C: on a German system:

D:\>setacl -on c:\ -ot file -actn list -lst f:tab -rec cont_obj

\\?\c:\

   DACL(protected+auto_inherited):
   VORDEFINIERT\Administratoren   full   allow   no_inheritance
   VORDEFINIERT\Administratoren   full   allow   container_inherit+object_inherit+inherit_only
   NT-AUTORIT─T\SYSTEM   full   allow   no_inheritance
   NT-AUTORIT─T\SYSTEM   full   allow   container_inherit+object_inherit+inherit_only
   VORDEFINIERT\Benutzer   read_execute   allow   container_inherit+object_inherit
   NT-AUTORIT─T\Authentifizierte Benutzer   change   allow   container_inherit+object_inherit+inherit_only
   NT-AUTORIT─T\Authentifizierte Benutzer   FILE_ADD_SUBDIRECTORY   allow   no_inheritance

\\?\c:\$Recycle.Bin

   DACL(protected+auto_inherited):
   VORDEFINIERT\Administratoren   full   allow   no_inheritance
   VORDEFINIERT\Administratoren   full   allow   container_inherit+object_inherit+inherit_only
   NT-AUTORIT─T\SYSTEM   full   allow   no_inheritance
   NT-AUTORIT─T\SYSTEM   full   allow   container_inherit+object_inherit+inherit_only
   VORDEFINIERT\Benutzer   read_execute+FILE_ADD_SUBDIRECTORY+FILE_WRITE_ATTRIBUTES   allow   no_inheritance

\\?\c:\$Recycle.Bin\S-1-5-21-3377029132-2631215491-2583730848-1000

   DACL(protected):
   VORDEFINIERT\Administratoren   full   allow   container_inherit+object_inherit
   NT-AUTORIT─T\SYSTEM   full   allow   container_inherit+object_inherit
   nb-hklein\hklein   full   allow   container_inherit+object_inherit

[...]

More examples of how to use SetACL can be found here.

share|improve this answer
add comment

The ones I have used are:

AccessEnum
DumpSec

I would not call these easy to read though. Sorry.

share|improve this answer
add comment

I use SetACL.exe, which is very quick, but it also produces very ugly output.

share|improve this answer
    
Do you know that SetACL has three listing modes: tabular, CSV and SDDL? The tabular mode is pretty easy to read - see my answer. –  Helge Klein Jan 14 '11 at 8:48
    
@Helge, your example merely proves my point about the very ugly output. Without post-processing any output involving more than a few entries is very difficult and time consuming to read. –  John Gardeniers Jan 14 '11 at 21:19
add comment

We use either SecURED from ManageRED Software or AccessReporter from Winzero. They both report NTFS and Share permissions in a user friendly format. (There is a free fully functional evaluation version of SecURED.)

Easy to understand reports in HTML format or exportable to CSV, XLS or text.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.