This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Permissions Analyzer not displaying NTFS permissions

When I try to analyze permissions on a file or folder, share permissions are enumerated correctly but not NTFS. The analyzer log file shows that it can find the AccessRightsDatabse object but the credentials for the domain are not available.  There are two domain controllers and the analyzer displays the same results regardless of which controller is used.  Does anyone have ideas of where I need to start looking to correct this issue?


Parents Reply Children
  • The only issue I can see right now is that you have an entry in the list of domain controllers for domain BBB but the search fails on not having credentials for domain BBB.CCC.DDD. Can you try specifying the full domain names in the settings?

    It appears from the log like there is no entry in the folder's NTFS access list for the SID of the user you are looking for, and it is not there even for the groups the user is a member of. Instead of trying the full path \\GGG\HHH\III, Check what happens with \\GGG\HHH\. If the III folder inherits all rights from HHH, it may not provide its own access list (this is just a theory).

  • I'm running the analyzer with a domain admin account so naturally it would have full permissions the file structure on member servers.  However, I believe I have stumbled upon what is causing the issue. I'm using Access Based Enumeration and any share that has ABE enabled I'm unable to see the NTFS permissions for files and folders in the analyzer.  If I change the file or folder setting to a share that does not have ABE enabled I'm able to see the NTFS permissions. 

  • That could be it. We did not consider Access Based Enumeration when Permissions Analyzer was in development.

  • If you can confirm that ABE is causing this problem, could we expect to see a new version of the analyzer in the near future.

  • I just checked that, and it appears like ABE does not influence the results. Could you perhaps post a screenshot of what you see?

  • Michal,

    This is the result using the domain admin credentials to show what permissions I have in my home folder.

    Actual NTFS permissions as listed by Windows Explorer: System: FC (inherited), Me: FC, Local Administrators Group : FC (inherited), My Boss: Read (inherited)

    Share permission - Everyone Change

  • Let me PM you and discuss the next steps offline.