Dumpsec file security report with unknown code

[Guest]

Hi i run a dumsec on the file server to check the NTFS file security for each users. The report happen to generate reports like

d:\temp domain\users R X
d:\temp domain\users AX00000002
d:\temp domain\users AX00000004

What does ax00000002 and 04 means? is there any documentation on that? Please help

[cmccullough]

Re: Dumpsec file security report with unknown code

DumpSec is running across a security setting that it doesn't understand. At this time we have no options for this, but later this summer we will have a better solution for security reporting.

[Guest]

Re: Dumpsec file security report with unknown code

any progress on DumpSec decoding these "?unknown" results? thanks, Michael

[kstanush]

Re: Dumpsec file security report with unknown code

DumpSec can't readily be fixed for this, as it was designed in a time when security settings were more simple, like read, write, execute, and delete. With the new security settings added on Windows 2000, DumpSec doesn't know how to report them.

We modified Exporter Pro to allow reporting security settings, although you get a lot of values. But our approach with Exporter Pro is to show every security setting, and then you can pare the output down however you want.

[Guest]

Re: Dumpsec file security report with unknown code

Thanks for a prompt answer. May any accurate conclusions be drawn about the "?unknown" code? For example, that it doesn't represent a current user? Or? Thanks, Michael

[kstanush]

Re: Dumpsec file security report with unknown code

The user information should be present, but the unknown portion concerns the security settings itself. If you are unclear, send a screen shot to [email protected].

[Guest]

Re: Dumpsec file security report with unknown code

The codes of ax00000002 and ax00000004 are most likely caused by the propagation information that applies to those specific permissions. ax00000002 generally indicates a container inheritance ACE while ax00000004 generally indicates a non-propagated inheritance ACE.

[kstanush]

Re: Dumpsec file security report with unknown code

Richter35 is correct; DumpSec was designed before the addition of the new inheritance features and these changes make its way of reporting security difficult to apply. We chose a different method of reporting security for that reason in Exporter Pro.