Re: User rights analysis

On Thu, 8 Sep 2005 22:15:56 +0400, "Dmitry Korolyov [MVP]"
<d__k@xxxxxxxxxxxxxxxxxxxxxx> wrote:

>Cannot be done using built-in tools. You should understand that this is a
>very hard thing to do, because in order to see the list of all permissions
>for a certain user on all resources in a forest, you first need to know
>which and which kinds of resources exist in this forest.


Agreed a very difficult thing to do, but it actually is possible now
through a 3rd party app called MyView. It's in it's baby stage and IMO
needs some more functionality but it basically creates a namespace for
each user in a domain. This "personal" namespace contains all the
resources the user has permissions to and can be mapped as a drive. It
can also determine which users have permissions to a shared resource.
It appears to use effective permissions and a bit of magic! Very very
cool but as I said IMO still needs some work as it doesn't have any
ability to output this information to say a file or printer... yet. I
can see a couple of other additions that would make this a kick ass
product. It's definitely something to check out as it fills a big hole
in AD where auditing permissions are concerned. The personal namespace
is also quite a benefit to users.

Disclaimer - No I do not work for the company or get compensation in
anyway but I do know a product with potential when I see it! :) YMMV

http://www.nuview.com/products/myview.asp


Mike
.

Relevant Pages

  • Re: Microsoft Security Groups
    ... resources, ... Global and Domain local groups for the past few ... > When would you use this group over a global group and why? ... > Microsoft recommends that you don't apply any permissions to the user ...
    (microsoft.public.security)
  • Re: Thinking outside the box on file systems
    ... If the /etc/shadow permissions depend on inherited ACLs to enforce access then that one little command just made your shadow file world-readable/writeable. ... I can probably have an open directory handle to a volume in a completely different namespace, a volume which isn't even *MOUNTED* in my current fs namespace. ... Yes, the effective acl of the open directory is kept in memory, but in the directory itself, not the handle to it, thus when the directory is moved, it's acl is recomputed for the new location and updated immediately. ...
    (Linux-Kernel)
  • Re: ADMT and SIDs
    ... but will the permissions need to be reassigned once ... >that is the SID from the old NT domain. ... >users will still be able to access resources in the NT ... >> existing user accounts along with the associated SID's, ...
    (microsoft.public.windows.server.active_directory)
  • Re: scanning sysfs to populate /dev
    ... the kernel only deals with devices by their device code. ... > Having a device namespace in the kernel, is a departure from that philosophy. ... > external policy, and now it is migrating to device drivers. ... permissions for any nodes it just creates them with the default permissions ...
    (comp.os.linux.development.system)
  • Re: User rigths for WMI access
    ... >> a namespace additional permissions may be required, ... > Our application performs querys to operating system classes (such as ... > We know a "local administrator" user can perform these queries, ...
    (microsoft.public.windowsxp.wmi)