I need to audit folder permissions on a network

daishi5

Golden Member
Feb 17, 2005
1,196
0
76
Here is the issue, at work we have a small/medium sized network with several file servers. Our AS/400 team performs an audit every year of access rights, and gives a report to the various department heads about what each of their employees can access. Now, they want this report for the network shares on the PC side of the network as well. We did have another employee working on this, but he has quit, and apparently he was recording all the share permissions by hand. On top of that, I already know of several mistakes and omissions in his records, so I am very sure I have to start over from scratch.

My boss is willing to pay for software if we can find anything that will allow us to get this data and export it to an excel spreadsheet or access database for the analyst's audit. I also have been looking at the windows 2000 resource kit, and the showacls.exe, perms.exe, and cacls seem to be promising apps, but I would somehow need to get the output into either excel or access. (our analyst says that with my help she could get it from excel to access, so thats why its an either or situation.)

If anyone has ever worked with something like this, or has any suggestions I am in need of some help.

Domain is primarily windows 2000 servers, with 4 windows 2003 servers.

Thank you.
 

gaidin123

Senior member
May 5, 2000
962
1
0
Heya,

This is probably not 100% of what you need but this will help you with the network share permissions. Sysinternals makes a ton of fantastic freeware. Shareenum is one of those.
http://www.sysinternals.com/Utilities/ShareEnum.html
Shareenum will go out on a domain and list all shares and the network share permissions. It will not list the file level permissions which you may need, but the network share ones are at least half of the info you need. :)

Gaidin
 

daishi5

Golden Member
Feb 17, 2005
1,196
0
76
That utility is excellent.

Unfortunately, our security is done by the folder and file level permission and not the share permission. Now if I could just find a utility just like that for the ntfs permissions I would be all set.
 

gaidin123

Senior member
May 5, 2000
962
1
0
Yeah having a tool like shareenum to collect all the ntfs permissions would be great to have. I typically use shareenum to find rogue/forgotten file shares but I'm curious if some tool can take the output from shareenum or just go out and check security permissions. I don't know if that's possible...

Gaidin
 

daishi5

Golden Member
Feb 17, 2005
1,196
0
76
Dumpsec seems to have given me the info that i needed. Its a bit mangled, and will need some work though. Its giving me individual file permissions, but cutting off file names on the import to access, and I have over half a million entries to work with. Then I need to start filtering and adding relationships from usernames to the groups they are in, but this is just what I needed to get started, and probably the hardest part for me is done.

Thank you.