Windows Forum

Ask something
Discussion Locked

global group rights

0 helpful
11 replies

by Member 35711908

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I'm taking over a net admin position for an NT network, and trying to clean up the existing users and groups. There are a number of groups that don't seem to have rights to anything that I can see, but is there a tool or a way to verify what rightsa given group has?

11 replies

by curlergirl

You can do the opposite (verify what groups or users have permissions to certain files) from the command line using the cacls command. You may already know about this - if not, go to the command prompt and type "cacls /?" and you'll get a list of the parameters and switches to use. Other than that, I don't know of any way except through some 3rd party software to do this natively in NT 4.0. Hope this helps!

by Member 35711908

Thanks, but it's more than 20 servers and hundreds of shares, so it'd take weeks to check them all. I'm looking for some way to do it by group.

by joncr

There is a great util that does much more besides that called Security Explorer. You can use it to search by group and user to find what they have access to.
Its well worth taking a look as we use it to back up permissions on file servers incase anyone propergates permissions and messes up the lot.
a workable demo is available from

http://www.smallwonders.com/

by Member 35711908

Thank you -- this is exactly what I'm looking for! Now to convince them to spend the money to get the full version.

by curacao_dejavu

Check if you on the nt resource kit.
There are serveral tools on it.
I recently used showacls.exe to show all users and groups that has access to a particular folder, I remember seeing something like you are looking for.
(Maybe you can use the showacls and then mark the groups and users that you find ? )

regards,

by Member 35711908

I didn't see anything that did this well -- there's a svrcheck, but it was clunky and didn't return all the data

by green lantern

It is pretty general practice to use Global Groups as a grouping container and use Local Groups for granting access to resources. THis is probably what you are seeing. Check your local groups and you will probably find your Global groups in there.

by bohicam1

Global groups are not assigned permissions. You place global groups into local groups and assign permissions on the local group only. This might lessen your workload somewhat if you only have to look at the local groups. If all the servers are in the same domain, the same list of users and groups will show up in each ones user manager for domains.
Good luck!

Mike

This discussion is closed to new replies.