Hi my name is Don Bishop and this is my “Deal” Today... Basically, anything that interest me. Music, Computers, Software, Apps, Linux OS's - Distros, Space, Science, Auto's, Trucks, 4x4's, Motorcycles and other slightly interesting info that I find on the Web. There may, or may not be, any correlation between my Posts. Just whatever interests me at the time. I hope someone out there finds some of this interesting too!:)
Search My Blog
Thursday, April 14, 2011
By Mark Russinovich
Published: December 9, 2010
As a part of ensuring that they've created a secure environment Windows administrators often need to know what kind of accesses specific users or groups have to resources including files, directories, Registry keys, global objects and Windows services. AccessChk quickly answers these questions with an intuitive interface and output.
AccessChk is a console program. Copy AccessChk onto your executable path. Typing "accesschk" displays its usage syntax.
Name is a Windows account right. Specify "*" as the name to show all rights assigned to a user. Note that when you specify a specific right, only groups and accounts directly assigned to the right are displayed.
Name is a Windows Service, e.g. ssdpsrv. Specify "*" as the name to show all services and "scmanager" to check the security of the Service Control Manager.
Only process directories or top-level keys
Only show explicitly set-Integrity Levels (Windows Vista only)
Show full process token information including groups and privileges
Ignore objects with only inherited ACEs when dumping full access control lists.
Name is a Registry key, e.g. hklm\software
Show full access control list. Add -i to ignore inherited ACEs.
Show only objects that have no access
Name is an object in the Object Manager namespace (default is root). To view the contents of a directory, specify the name with a trailing backslash or add -s. Add -t and an object type (e.g. section) to see only objects of a specific type.
Name is a process name or PID, e.g. cmd.exe (specify "*" as the name to show all processes). Add -f to show full process token information, including groups and privileges. Add -t to show threads.
Show only objects that have read access
Object type filter, e.g. "section"
Verbose (includes Windows Vista Integrity Level)
Show only objects that have write access
If you specify a user or group name and path, AccessChk will report the effective permissions for that account; otherwise it will show the effective access for accounts referenced in the security descriptor.
By default, the path name is interpreted as a file system path (use the "\pipe\" prefix to specify a named pipe path). For each object, AccessChk prints R if the account has read access, W for write access, and nothing if it has neither. The -v switch has AccessChk dump the specific accesses granted to an account.