Powershell – NTFS Permissions Auditing with PowerShell

Thanks, "unknown". Your PowerShell script doesn't work for me, but I hacked together something that does. I'm new to it, too, but after some trial and error:

Get-ChildItem "C:\SOME\DIR" -recurse | 
    ForEach-Object { 
        $fname = $_.FullName
        $acl = Get-Acl $fname
        foreach ($e in $acl.Access) {
            If ( -not $e.IsInherited -and
                 $e.AccessControlType -eq "Allow" -and 
                 $e.IdentityReference -eq "SOMEDOMAIN\Somegroup") 
            {
                Write-Host $fname
                break
            }
        }
    }

Somebody with PowerShell kungfu could probably clean this up a bit. Note that I have it ignore inherited entries, because I'm only interested in knowing where the access begins.

What you are looking at is known as Special Permissions. I would highly recommend you read this article at Windows Security that covers and explains in detail how security on NTFS works.

Warning: Be careful when testing security with IIS. IIS has another layer of security which is not linked to NTFS, however it will enforce NTFS permission. Also locking down folders for a specific user will not affect anonymous website access, where IIS uses it's own account, and not the logged in user, to specify access.