Windows – Tool to see nested permissions

file-permissionspermissionswindowswindows-server-2008

Here's the situation. Often I need to tell how a user is getting access to a specific folder. I can see in "Effective permissions" that they have read/write/etc, but because of nested groups I can't immediately tell why.

I'd like a tool/script that I can run that will take the input of a path, and user and tell me how that user has permissions.

Example.

I'm on Server01 and I browse to c:\folder and I see that user MathewC has effective permissions to write, but when I look at the permissions for the folder, I can see that many groups have access to write, but I don't know which of those groups MathewC is a memeber of.

So, the permissions of the folder would look like this:

C:\folder

Group 01 Read/Write
Group 02 Read/Write
Group 03 Read/Write
…
Group 99 Read/Write

And the tool/script would report back

User MathewC is a memeber of "Group 42" which has Read/Write access.

Or even more complex:

User MathewC is a memeber of "Group humans" which is a member of "Group 42" which has Read/Write access.

Best Answer

Technically this question (and this answer) are Off-Topic as "shopping" but I'll try and help you out.

You should be able to use Chris' NTFS Permissions Reporter to do what you need. I've been using it for a while now.

NTFS Permissions Reporter

The free one can basically do what you are asking.

For instance, you can ask about a specific folder like: "\server01\share\folder\subfolder" and set the options as below:

enter image description here

Then after the report runs, you can click on one of the users in the results pane to see how they got their effective permissions and from what Group.

enter image description here

Hope that helps.

Related Solutions

DFS-R NTFS Permissions Not Working

The details in your question make it sound like you're doing everything right. But in the interest of troubleshooting, I would probably take DFS out of the equation first. Just setup the share on one of the servers and make sure connecting directly to that share works how it's supposed to. Then add DFS back into the mix and see if it breaks. At the very least, it should verify whether your problem is specifically related to DFS or not.

You might also double check that the subfolder you're accessing is properly inheriting permissions from the parent (assuming it's supposed to be in the first place).

How to Assign Permissions to ApplicationPoolIdentity Account

Update: The original question was for Windows Server 2008, but the solution is easier for Windows Server 2008 R2 and Windows Server 2012 (and Windows 7 and 8). You can add the user through the NTFS UI by typing it in directly. The name is in the format of IIS APPPOOL\{app pool name}. For example: IIS APPPOOL\DefaultAppPool.

IIS APPPOOL\{app pool name}

Note: Per comments below, there are two things to be aware of:

Enter the string directly into the "Select User or Group" and not in the search field.
In a domain environment you need to set the Location to your local computer first.

Reference to Microsoft Docs article: Application Pool Identities > Securing Resources

Original response: (for Windows Server 2008) This is a great feature, but as you mentioned it's not fully implemented yet. You can add the app pool identity from the command prompt with something like icacls, then you can manage it from the GUI. For example, run something like this from the command prompt:

icacls c:\inetpub\wwwroot /grant "IIS APPPOOL\DefaultAppPool":(OI)(CI)(RX)

Then, in Windows Explorer, go to the wwwroot folder and edit the security permissions. You will see what looks like a group (the group icon) called DefaultAppPool. You can now edit the permissions.

However, you don't need to use this at all. It's a bonus that you can use if you want. You can use the old way of creating a custom user per app pool and assigning the custom user to disk. That has full UI support.

This SID injection method is nice because it allows you to use a single user but fully isolate each site from each other without having to create unique users for each app pool. Pretty impressive, and it will be even better with UI support.

Note: If you are unable to find the application pool user, check to see if the Windows service called Application Host Helper Service is running. It's the service that maps application pool users to Windows accounts.

Related Topic