Windows Server

dimsdale_007 · Guest

looking for software that will scour network or even a server at a time and
come up with a list of permissions for each folder/file on the server. i
don't want to have to do a manual command line list for each folder/file on
every server. i have the wonderful job of figuring out if my servers are
secure..woohoo

if anyone knows how to do this in windows or any 3rd party software i'd
appreciate it!

thanks!

Steven L Umbach · Guest

Dumpsec from Somarsoft is free and can do such. Hyena can do much more, but
is not free. Sysinternals also has a number of tools including one that can
the network for shares to enumerate permissions. Network scanners such as
Languard can also do such, for at least shares. The links below will take
you to those utilities. --- Steve

http://www.somarsoft.com/somarsoft_main.htm
http://www.sysinternals.com/ntw2k/source/shareenum.shtml
http://www.gfi.com/languard/

"dimsdale_007" <dimsdale007@discussions.microsoft.com> wrote in message
news:46EAE83C-A2D2-4783-97F8-BF04117D5C9A@microsoft.com...

dimsdale_007 · Guest

i need not only share permission...but ntfs permissions too...is there
software that does this?

thanks

"Steven L Umbach" wrote:

Roger Abell [MVP] · Guest

one and the same dumpsec

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCDBA, MCSE W2k3+W2k+Nt4
"dimsdale_007" <dimsdale007@discussions.microsoft.com> wrote in message
news:6D1D8016-DC4A-4C84-B7B3-77F295D22A8A@microsoft.com...

Roger Abell [MVP] · Guest

Of course, figuring out if your servers are secure is more than just
knowing the accesses defined in NTFS and the shares.

However, for the NTFS and shares part, what can often be more
productive, even in the near-term but especially in the long run, is
to step back and ask
1. what is stored here - and map it out
2. who should be able to get to what and in which ways
then, ask
3. can I reorganize this at all so that things are more uniform
(stuff with same answer to 2 maybe can be stored together
rather than in bits and pieces on 4 partitions, etc.)

Now, if you really did 1 and 2 completely, then you should be
able to just ACL it so that it is as it should be.
Access that get broken are not supposed to be allowed.

And, if you can do 3 effectively, then you should end up with a
not too complicated, irregularly ACLed store, and that means
one for which you can likely define a security template so that
you can in the future
a) analyze and see if anything is not ACL'd as it should be
b) apply so that it is as it should be if it gets out of line

If the storage does not involve a lot of per-account personal
stores, and if your custom groups are already defined so you
can answer 2 in terms of them, then often doing 1 and 2 is
less effort than trying to read the dumpsec and similar programs'
outputs and then thunking through them.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCDBA, MCSE W2k3+W2k+Nt4
"dimsdale_007" <dimsdale007@discussions.microsoft.com> wrote in message
news:46EAE83C-A2D2-4783-97F8-BF04117D5C9A@microsoft.com...

Steven L Umbach · Guest

As Uncle Roger replied, Dumpsec can do both. I listed the others also not
quite sure of exactly what you were looking for. Shareenum is great if you
need to scan just for shares on the network. --- Steve

"dimsdale_007" <dimsdale007@discussions.microsoft.com> wrote in message
news:6D1D8016-DC4A-4C84-B7B3-77F295D22A8A@microsoft.com...

	Windows Server Forum Index -> Security	All times are GMT
Page 1 of 1