Solved

exporting security groups assigned to folders

Posted on 2016-10-26
3
35 Views
Last Modified: 2016-11-15
Hello. I need to find out which security groups are assigned to folders share permissios(folders exist on a file share server). does anyone have a script for powershell or a free tool that we can use to obtain this. please let me know.
0
Comment
Question by:Newguy 123
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 24

Accepted Solution

by:
NVIT earned 250 total points (awarded by participants)
ID: 41862651
Use AccessEnum

https://technet.microsoft.com/en-us/sysinternals/accessenum.aspx

AccessEnum uses standard Windows security APIs to populate its listview with read, write and deny access information.

You can export to CSV file format.
0
 
LVL 43

Assisted Solution

by:Steve Knight
Steve Knight earned 250 total points (awarded by participants)
ID: 41862822
If you want a script aswell I used this powershell recently to document permissions set on each folder down tree of a file server... in that case was looking on a drive mapped to S:

There are four things to edit.  The $outfile to point to where you want CSV results.  $RootPath to where you want it to navigate down from and in this line we excluded two groups that wanted excluding.  Amend them or remove them as needed.

Steve

and !($ACL.IdentityReference -eq "DomainName\Domain Admins") -and !($ACL.IdentityReference -eq "DOMAIN\Some Shared Group"))

Open in new window


$OutFile = "c:\somedir\Permissions.csv" 
 $maxdepth = 5
 $RootPath = "S:\" 
 $actual_depth_param = [int]([regex]::Matches($RootPath, "\\")).count + [int]$maxdepth + 0
 $Folders = dir $RootPath -recurse | where {$_.psiscontainer -eq $true}

 foreach ($Folder in $Folders)
 { 
     if (([regex]::Matches($Folder.fullname, "\\")).count -lt $actual_depth_param)
     { 
         $ACLs = get-acl $Folder.fullname | ForEach-Object { $_.Access } 
         Foreach ($ACL in $ACLs)
         { 
             if (($ACL.IsInherited -eq $FALSE) -and !($ACL.IdentityReference -eq "DomainName\Domain Admins") -and !($ACL.IdentityReference -eq "DOMAIN\Some Shared Group"))
              {
                 $OutInfo = "`"" + $Folder.Fullname + "`",`"" +  $ACL.IdentityReference + "`",`"" + $ACL.AccessControlType + "`",`"" + $ACL.IsInherited + "`",`"" + $ACL.InheritanceFlags + "`",`"" + $ACL.PropagationFlags + "`",`"" + $ACL.FileSystemRights + "`""
Add-Content -Value $OutInfo -Path $OutFile
              }

         }
     }
 }

Open in new window

0
 
LVL 24

Expert Comment

by:NVIT
ID: 41887615
Question answered.
0

Featured Post

Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question