Query NTFS Permissions for Specific Group Within Entire Domain

Is it possible to query my entire domain to see if/where a specific group has NTFS permissions to files/folders? I know I can do it by Share or by groups of Shares by selecting a specific server but can I do it from a higher level without having to go through each server?

Thanks.

[cmccullough]

Re: Query NTFS Permissions for Specific Group Within Entire Domain

You can do that using Exporter Pro:

In Hyena select the server or servers that you want to search, then go to
Tools->Exporter Pro->Export Selected Objects.
Click the Settings button, then double-click on Security Access.
Check the box to Export Security Information and enter an Output File Name.

For share permissions, check the box for shares and choose the type of shares you want reported on. For NTFS file and directory permissions check the box for Files and Directories.

Check the box to only export information for users/groups listed in this file. Enter a filename that will contain the users/groups you want to search for. The file doesn't have to exist yet because when you click the Edit button Notepad will open and ask you if you want to create it. In the file you will list, one per line, the users and/or groups you want to search for.
Then click OK to close that dialog.

If you enabled NTFS file and directory permissions, you'll also need a File/Directory template, so double-click on File/Directory. Click the New button at the bottom, give it a Template Name and an Output File Name. If you only want to search directories, check the box for that, then click the Add button beside Shared Directory Paths. Choose the shares you want, how far down you want it to scan, then click OK.

Security Access and File/Directory should be the only options enabled on this screen, if there is anything else enabled, double-click on them and disable them. When done, click Close and click Start Export.

When finished you can open the output file specified on the Security Access
tab with Excel and see the places those users or groups was found.

Re: Query NTFS Permissions for Specific Group Within Entire Domain

Thanks for the info, that's just what I needed. My last question related to this is, is this process single-threaded or multi-threaded? I'm just wondering how much it's going to tax the server. Thanks.

[cmccullough]

Re: Query NTFS Permissions for Specific Group Within Entire Domain

It will run in a single-thread. As far as taxing the server, it should be comparable to doing a dir /s c: from the Command Prompt in that it will need to read the ACL from each file/directory one at a time.