List all files that have write access by a specific user

Hi all,

I've been hit with one of those crypto-ransom viruses. A specific user ("domain\username") has had all files that they have write permissions to encrypted. Now I need to restore these files from DPM, but first I would like to know what files on the file server they have write access to.

So in Windows, is there a way I can generate a list of files that user ("domain\username") has write access to?

Thanks for reading.
Who is Participating?
WaronyaConnect With a Mentor Commented:
Try the free AccessEnum tool (  AccessEnum is a very simple application that helps you visualize the permissions assigned to a specific folder structure.
Have you cleaned the virus yet? I think it would be better to isolate/disinfect the virus first before restoring as they will attack again.

Try these tools I have used fix a similar problem make the files accessible.  
1. Adwcleaner
2.  Combofix

Once done disinfecting ensure you have a good working antivirus with the latest signature updates.
StengleAuthor Commented:
Hi Waronya,

Yes I cleared up the virus ASAP. Most files that the guy had access to have been encrypted and we are not paying the decryption fee - the only way we can get our files back it to restore them from DPM.

Which is why I need to know if there is a way I can generate a list of files that this guy has write access to.
StengleAuthor Commented:
Great tool, thanks Waronya. Your link also took me to:
Which is also nice :-)
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.