permREADER

permREADER is a simple portable app for reading the permissions of file shares. Usually, the scan of a file share is also the starting point for file server optimization.

Starting from a file share, permREADER reads all folders and their permissions recursively and writes this information to a .csv file. Within the file you can analyze the individual permissions and the detailed information (inheritance, propagation …).

The app can simply be executed on a server or client with administrative permissions, after which a console window opens,  in which a UNC share must be entered. The permREADER then scans the folder structures and their permissions and outputs them in a .csv file. Based on the scanned permissions, you can adapt the .csv file to your own requirements and then roll out the permissions using permWRITER.

permWRITER

permWRITER can be used to reassign permissions to file shares in accordance with current Microsoft best practices.

In a .csv file, you define the individual folders and the required permissions for individual user or group objects (e.g. folder “\\Server\Share\Departments\Purchasing” should receive a “Change” permission for the AD group “Purchasing”). The permWRITER then creates the required permission group as well as the necessary list permissions (these ensure that the members of the AD group “Purchasing” from the previous example are able to navigate to the folder “Purchasing”) in the Active Directory, nests the correct members in the created groups and writes the permission groups to the folder in the ACL.

These features are inclued in permWRITER:

• Creation of the required Active Directory groups
• Creation of permissions according to Microsoft best practices
• Creation of list permissions on the first three folder levels (for deeper permissions, the permission group continues to be used as a list permission so as not to affect the Kerberos token unnecessarily)
• Free definition of the group name scheme
• Free definition of the group type (global, domain local, universal)

The permWRITER supports various customization paths. The preferred path is usually the cleanup for a new, empty target share. This has the advantage that assigning permissions is much faster. The application is also able to add new permissions to existing shares. However, the old permissions on the existing share must then be cleaned up using permREMOVER.

The permissions created with permWRITER are 100% compatible with tenfold and can be used immediately.

permREMOVER

With permREMOVER, the old permissions can be removed after new permissions have been assigned.

If you have decided against transferring your data to a new, empty target share and only want to change your permissions on the folders in accordance with Microsoft best practices, the old permissions must be removed after the new permissions have been assigned.

To do this, you only need to inform permREMOVER of a UNC share, which it then checks recursively for explicitly set permissions and removes them. A whitelist is taken into account, which you can use to control which of the permissions on the folders are retained.

These features are inclued in permREMOVER:

• Revocation of explicit permissions on a fileshare
• Whitelist for accounts that should not be removed