AclScanner

ACL Scanner is a simple tool that helps track down issues with NTFS Access Control Lists (ACLs). The tool analyses a file system and filters out the changes made to the access control lists, showing only the changes not the inherited permissions. The output is a list of all essential changes to a file system's security settings.

This tool was created to aid in the migration of data from one machine to another. When restoring a Windows backup file, the original SID (Security ID's) are restored. This can be a problem when the originating files are from a different domain or the files have permissions for local users. Tracking down all permissions that need to be updated by hand is a real pain, this tool automates this.

In addition, this tool helps register changes to the filesystem required for services to run (like a webserver).

Usage

The tool does not require any installation; simply copy the tool and invoke it with the start directory as a parameter:

AclScanner "c:\InetPub"

Below you'll find an excerpt of the output on a Windows XP machine:

C:\Inetpub
Owner : SERVER001\mike
Inherited rules:
        BUILTIN\Administrators
                Allow Full control
        NT AUTHORITY\SYSTEM
                Allow Full control
        SERVER001\mike
                Allow Full control
        CREATOR OWNER
                Allow
        BUILTIN\Users
                Allow Read and execute, Synchronize
        BUILTIN\Users
                Allow Create directories
        BUILTIN\Users
                Allow Create files

...

C:\Inetpub\wwwroot
        SERVER001\IUSR_SERVER001
                Deny Write, Delete, Change permissions, Take ownership
        SERVER001\IWAM_SERVER001
                Deny Write, Delete, Change permissions, Take ownership
        CREATOR OWNER
                Allow
        NT AUTHORITY\SYSTEM
                Allow Full control
        BUILTIN\Administrators
                Allow Full control
        BUILTIN\Users
                Allow Create files
        BUILTIN\Users
                Allow Read and execute, Synchronize
        BUILTIN\Users
                Allow Create directories
        SERVER001\mike
                Allow Full control

...