Documenting NTFS permissions

[OzDog]

Posted this in the Win2K Server forum, but no response - maybe someone here can help??...

Guys & Girls,

I have been charged with the task of auditing and rationalising all security on our NT/Win2K file servers. This is going to be a real nightmare, as there are 4 TerraBytes of data, spread across 3 servers to analyze.

The only way I can see this being done is via a program that can list all permissions through specified paths on a server (eg - Data Drives, not system/boot partitions). I wish I could say that I don't need file level permissions (as our IT dept always use Global and Local groups), but I know that end-users don't understand this, and set their own permissions "willy-nilly".

I need the output to be intuitive, so that I find answers to the following FAQs (with regard to the scanned servers):
1. "What has UserX in the DeptX got access to?"
2. "What has the group 'XYZ' got access to?"
3. "What access will UserY get if I make them a member of the group 'XYZ'?".
I would also like to be able to find groups that have become redundant, are empty or are the same as some other groups.

I am happy to write my own SQL or similar to interrogate the data, so long as the program can populate an appropriate data source.

I've tried DumpSec from SystemTools.com, and don't like the way it works on bigger systems - I'm sure it's great on a single workstation or something. Anyone have ideas on the tool I need here?

Cheers,
Sam

Please let members know if you found their posts helpful.

 

[jtb]

Windows 2003 Advanced Server will have some of the functionality you're needing... right now, I don't think there are any automated ways to determine it...

A really, really good reason to limit the number of Domains, Sites, OUs, and etc. to a minimum and manage them centrally, eh?

There are things that you can do to prevent them from changing permissions... SPE and GPO things...

Good luck!!

JTB
Solutions Architect
MCSE-NT4, MCP+I, MCP-W2K, CCNA, CCDA,
CTE, MCIWD, i-Net+, Network+
(MCSA, MCSE-W2K, MCIWA, SCSA, SCNA in progress)

 

[BOKA]

Take a look here:

http://www.miclog.com

Their DiskMapper utility is may be of use.

Good luck.

 

[comtec17]

Hope this link helps you. I use it to create reports of all my files and their permissions.

http://www.sunbelt-software.com/product.cfm?id=787

 

[OzDog]

Jtb - Thanks, but no - NT4. Security Groups & File Permission audit before AD & Win2K upgrade.

Boka, Comtec17 - Thanks, will check them out.

Cheers,
Sam

Please let members know if you found their posts helpful.

 

[Lourensia]

Have a look at this site

http://www.sysinternals.com/ntw2k/utilities.shtml

some very handy tools,