Backtracking from a folder to AD groups

manitoba_RDC

3/10/24, 3:47 PM

Good morning! I'm looking for a powershell script that will let me obtain a list of Active Directory groups with access to a particular folder on my server, but these groups are twice-removed from the folder. I want to backtrack from the folder to the particular AD group granting permissions to that folder, and then from that particular AD group to each of the individual groups that are being granted access. Is it possible for me to tackle this purely from the AD groups and not worry about the folder at all? Thanks! Ian

1 + 2

windows

active-directory

joeqwerty

3/10/24, 8:11 PM

I use this tool all of the time. It can list group members and nested group members related to the ACL's on the shared folders. - http://www.cjwdev.com/Software/NtfsReports/Info.html

manitoba_RDC

3/20/24, 3:59 PM

Thanks! Unfortunately due to being in an offline environment we are unable to download or install any additional tools.

Score:1

Server

mfinni

3/10/24, 6:20 PM

Is it possible for me to tackle this purely from the AD groups and not worry about the folder at all?

No. ACLs are defined on the filesystem object (your folder), not in AD itself.

You would need to query the folder, list all the ACLs on it, extract all the security principals (users and groups, Get-ACL calls this the IdentityReference), and then recursively expand each group until you only have a list of users. Sounds like you would want to collect the list of groups as you go, also.

So yeah, you could absolutely write that in Powershell, it's probably the best tool to do it. You would probably even find other people's work in public github repos to do the "group expansion" function. That can get tough if you need to go cross-domain or cross-forest.

+ 1

manitoba_RDC

3/20/24, 3:58 PM

Thanks for the reply, it is greatly appreciated!

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Backtracking from a folder to AD groups

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.