ActiveDirSec.Org

The world's most trusted forum on Active Directory Security


Post Info TOPIC: How to analyze individual Active Directory security permissions / rights ?


Newbie

Posts: 4
Date: Jan 3, 2013
How to analyze individual Active Directory security permissions / rights ?
Permalink  
 


Hello,

I am trying to find out what rights one of our contractors has on one of our OUs so I am looking at the ACL on the OU to try and make this determination. However, there are many ACEs in the ACL, and many of them grant more than one type of access rights (e.g. Read Property and Write Property, or Write Property, Create Child and All Extended Rights etc.) so I am facing a challenge in trying to list all the ACEs that grant a specific access right / security permission i.e. Create Child on this organizational unit.

Is there any way I can view the ACL of the object such that I can sort the ACL based on the individual access rights granted in them, so I can identify all ACEs the grant this Create Child permission?

If so, it would be very helpful. For example, even if I can export the ACL to an excel file such that all of the access right flags can be listed in individual columns, that would be super helpful and sufficient.

Thank you for your help.

Jorge.



__________________

I'm digging my new Microsoft Surface Tablet.

Ray


Member

Posts: 17
Date: May 30, 2013
RE: How to analyze individual Active Directory security permissions / rights ?
Permalink  
 


Dear Jorge,

If you're looking to sort an Active Directory object's ACL/permissions based on a specific permission type, as specified in the access-mask field of the ACL, I think this should help. 

In my experience, I have found it to be the easiest way to view/analyze Active Directory ACLs by individual security permissions / access rights, such as Extended Rights etc., especially in situations where there are mulitple permissions specified in the access mask.

Good luck.

Ray.



__________________
One misconfigured 00299570-246d-11d0-a768-00aa006e0529 is all I need.
Page 1 of 1  sorted by
Quick Reply

Please log in to post quick replies.

Post to Digg Post to Del.icio.us
Members Login
Username 
 
Password 
    Remember Me