Announcement

Collapse
No announcement yet.

Dumpsec file security report with unknown code

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Dumpsec file security report with unknown code

    Hi i run a dumsec on the file server to check the NTFS file security for each users. The report happen to generate reports like

    d:\temp domain\users R X
    d:\temp domain\users AX00000002
    d:\temp domain\users AX00000004

    What does ax00000002 and 04 means? is there any documentation on that? Please help

  • #2
    Re: Dumpsec file security report with unknown code

    DumpSec is running across a security setting that it doesn't understand. At this time we have no options for this, but later this summer we will have a better solution for security reporting.

    Comment


    • #3
      Re: Dumpsec file security report with unknown code

      any progress on DumpSec decoding these "?unknown" results? thanks, Michael

      Comment


      • #4
        Re: Dumpsec file security report with unknown code

        DumpSec can't readily be fixed for this, as it was designed in a time when security settings were more simple, like read, write, execute, and delete. With the new security settings added on Windows 2000, DumpSec doesn't know how to report them.

        We modified Exporter Pro to allow reporting security settings, although you get a lot of values. But our approach with Exporter Pro is to show every security setting, and then you can pare the output down however you want.
        Kevin Stanush
        SystemTools Software Inc.

        Comment


        • #5
          Re: Dumpsec file security report with unknown code

          Thanks for a prompt answer. May any accurate conclusions be drawn about the "?unknown" code? For example, that it doesn't represent a current user? Or? Thanks, Michael

          Comment


          • #6
            Re: Dumpsec file security report with unknown code

            The user information should be present, but the unknown portion concerns the security settings itself. If you are unclear, send a screen shot to [email protected].
            Kevin Stanush
            SystemTools Software Inc.

            Comment


            • #7
              Re: Dumpsec file security report with unknown code

              The codes of ax00000002 and ax00000004 are most likely caused by the propagation information that applies to those specific permissions. ax00000002 generally indicates a container inheritance ACE while ax00000004 generally indicates a non-propagated inheritance ACE.

              Comment


              • #8
                Re: Dumpsec file security report with unknown code

                Richter35 is correct; DumpSec was designed before the addition of the new inheritance features and these changes make its way of reporting security difficult to apply. We chose a different method of reporting security for that reason in Exporter Pro.
                Kevin Stanush
                SystemTools Software Inc.

                Comment

                Working...
                X