How to get an ACL exception report

Archived from groups: microsoft.public.win2000.security (More info?)

I'm looking for a program that will summarize ACL settings on a directory
structure. I'd be happy with an option to use with XCACLS * /T that showed
only settings that are not inherited from a parent.

If I'm checking the security of a filesystem, it's impractical to check the
security of every single file -- and highly redundant, as most files simply
inherit ACLs from the parent folder. Yet any tool I've found lists ACLs in
excruciating detail, burying important differences in a mass of irrelevant
inherited data.

I'm sure such a tool exists somewhere. Heck, Novell had it years ago --
but then, their security structure was more efficient (;-/2).

/kenw
Ken Wallewein
K&M Systems Integration
Phone (403)274-7848
Fax (403)275-4535
kenw@kmsi.net
www.kmsi.net

Archived from groups: microsoft.public.win2000.security (More info?)

Those are great! Thanks!

They're still a little verbose, displaying redundant information, but a lot
better than the Microsoft blunt instruments.

/kenw


"Steven L Umbach" <n9rou@nospam-comcast.net> wrote:

>Dumpsec is a nifty free tool and it may be able to do what you want if you
>check the options in the "permissions report options". Another tool to check
>is fileacl. I don't know if it can do exactly what you want but it has a
>myriad of options including a /noinherited switch for display mode. ---
>Steve
>
>http://www.systemtools.com/somarsoft/ -- Dumpsec
>http://www.gbordier.com/gbtools/fileacl.htm -- Fileacl
>
><kenw@kmsi.net> wrote in message
>news:5nvt31t921aheemkflp8f9027ibjv3vb88@4ax.com...
>> I'm looking for a program that will summarize ACL settings on a directory
>> structure. I'd be happy with an option to use with XCACLS * /T that
>> showed
>> only settings that are not inherited from a parent.
>>
>> If I'm checking the security of a filesystem, it's impractical to check
>> the
>> security of every single file -- and highly redundant, as most files
>> simply
>> inherit ACLs from the parent folder. Yet any tool I've found lists ACLs
>> in
>> excruciating detail, burying important differences in a mass of irrelevant
>> inherited data.
>>
>> I'm sure such a tool exists somewhere. Heck, Novell had it years ago --
>> but then, their security structure was more efficient (;-/2).
>>
>> /kenw
>> Ken Wallewein
>> K&M Systems Integration
>> Phone (403)274-7848
>> Fax (403)275-4535
>> kenw@kmsi.net
>> www.kmsi.net
>

Ken Wallewein
K&M Systems Integration
Phone (403)274-7848
Fax (403)275-4535
kenw@kmsi.net
www.kmsi.net