How would one see conveniently which users exactly have which permissions on a folder when a folder's Security tab has many usergroups?

I'm specifically looking for some technique or a GUI/CLI tool which lists individual users and their permissions for the folder.

I googled and checked out DumpSec and Hyena but they didn't seem to have an option to dump individual users.

  • methinks a powershell script is needed here – SpacemanSpiff May 25 '12 at 14:16

Have you looked into the SysInternals suite by Mark Russinovich? It's a Microsoft distributed suite of utilities for Windows server administration. In particular, I would recommend checking out the included tools, "AccessChk" and "AccessEnum"

SysInternals - http://technet.microsoft.com/en-us/sysinternals/bb842062

AccessEnum - http://technet.microsoft.com/en-us/sysinternals/bb897332

They may do more than you're looking for, but they might might help.

  • I ended up using AccessChk from SysInternals. Even though it does not resolve usergroups to individual users, it is cli based and I can schedule it to run at midnight and dump the results to a file and commit any possible changes to Git. :-) – Henno May 26 '12 at 18:45

1. When in the Security Tab of the folder, click on the Advanced button.

2. Go to the "Effective Permissions" Tab of the newly opened window.

3. Now select the Group or User Name by clicking on the "Select" button.

The Effective Permissions of the User (or Group) will be shown in the window below...

When you specifically asked for a GUI Tool, I thought that you may not have used the "Effective Permissions" tab before, but if in any case you have, sorry for the inconvenience...

Hope this helps...

Update : The Effective Permissions tool only produces an approximation of the permissions that a user has. The actual permissions the user has may be different because permissions can be granted or denied based on how a user logs on. This logon-specific information cannot be determined by the Effective Permissions tool if the user is not logged on; therefore, the effective permissions it displays reflect only those permissions specified by the user or group and not the permissions specified by the logon.

For example, if a user is connected to this computer through a shared folder, then the logon for that user is marked as a network logon. Permissions can be granted or denied to the Network well-known SID, which the connected user receives, so a user has different permissions when logged on locally than when logged on over a network.

  • I was aware of Effective Permissions technique to verify the permissions of ONE user account. I wasn't aware that it is an approximation and +1'd your answer for that. – Henno May 26 '12 at 18:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.