In this post, I’ll show you how to use PowerShell to generate an NTFS permissions report, an essential part of effective permissions management. If you’re responsible for managing permissions across files and folders, especially in enterprise environments, understanding how to extract and analyze access control data is important. This guide demonstrates how the Get-Acl cmdlet can be used to retrieve detailed permission information.
Key Definitions
NTFS permissions are access control settings applied to files and folders on Windows NTFS-formatted drives that determine which users or groups can read, write, modify, or execute resources.
Get-Acl is a PowerShell cmdlet that retrieves the security descriptor (access control list) for a specified resource, returning detailed information about who has access and what level of permissions they hold.
Prerequisites
Before running these commands, ensure you have:
- Windows PowerShell 3.0 or later (PowerShell 5.1+ recommended)
- You must have sufficient permissions to read the security descriptors of the target files and folders. Administrative privileges may be necessary for protected resources.
- Administrative privileges may be required for certain protected directories
How to use Get-Acl to find NTFS Permissions
The PowerShell Get-Acl cmdlet can be used to return permissions on objects like files, folders, and registry keys. The example below gets the permissions set on the C:\temp folder and all the available properties.
(Get-Acl -Path C:\temp).AccessWhat Get-Acl Returns
The Get-Acl cmdlet returns the following key properties:
Limitation
Important: Get-Acl alone cannot recursively return permissions for all folders in a hierarchy. You must combine it with Get-ChildItem -Recurse to enumerate folders and then pass each result to Get-Acl.
If you want to know the permissions set on all folders in a directory tree, you need to use the Get-ChildItem cmdlet with the -Recurse parameter to list all the folders in the tree and then pass the results to Get-Acl using a ForEach loop.
Step-by-Step: Recursive NTFS Permissions Script
The script below retrieves permissions for all folders in a directory tree:
-
- Define the folder path and retrieve all subfolders recursively using Get-ChildItem -Directory -Recurse
- Initialize an empty array to store the output results
- Loop through each folder and use Get-Acl to retrieve its access control list
- For each access control entry (ACE), extract the relevant properties into an ordered list
- Output the results to Out-GridView for easy sorting and filtering:
$RootPath = "C:\temp" $Items = @( Get-Item -LiteralPath $RootPath -ErrorAction Stop Get-ChildItem -LiteralPath $RootPath -Recurse -Force -ErrorAction SilentlyContinue ) $Output = @( foreach ($Item in $Items) { try { $Acl = Get-Acl -LiteralPath $Item.FullName -ErrorAction Stop foreach ($Access in $Acl.Access) { [PSCustomObject]@{ Path = $Item.FullName ItemType = if ($Item.PSIsContainer) { "Folder" } else { "File" } IdentityReference = $Access.IdentityReference.Value FileSystemRights = $Access.FileSystemRights.ToString() AccessControlType = $Access.AccessControlType.ToString() IsInherited = $Access.IsInherited InheritanceFlags = $Access.InheritanceFlags.ToString() PropagationFlags = $Access.PropagationFlags.ToString() } } } catch { Write-Warning "Cannot read permissions for $($Item.FullName): $_" } } ) $Output | Out-GridView $Output | Export-Csv -Path "C:\temp\NTFS-Permissions.csv" -NoTypeInformation
Important: The PowerShell script reports NTFS access control entries (ACEs), including permissions assigned directly to users and groups and permissions inherited from parent folders. It does not calculate a user’s effective permissions, which can depend on group membership, Allow and Deny entries, and other access controls. When files are accessed over a network share, share-level permissions must also be considered.
How Lepide Helps
It’s critical that you understand both current and historic File Server permissions to help prevent privilege abuse and maintain a policy of least privilege. Our Lepide File Server Auditor can easily analyze current effective permissions held by users on files and folders, as well as changes made to permissions, inherited permissions, direct permissions and indirect permissions. Click here to know more.
The following screenshot of Lepide File Server Auditor shows current permissions by users:
Figure 1: Permissions by users report
In addition to the permissions reports shown above, you can also identify and remove excessive permissions for an object using supported Lepide remediation capabilities.
Figure 3: Remove Excessive Permissions
Apart from doing permission analysis, you can also audit changes made to your files and folders in real-time and get detailed audit reports with Lepide File Server Auditor.
Frequently Asked Questions
After generating the NTFS permissions report, use the Export-Csv cmdlet to save the results to a CSV file:$Output | Export-Csv -Path "C:\temp\NTFS-Permissions.csv" -NoTypeInformation
The CSV report includes file and folder paths, user and group accounts, assigned permissions, Allow/Deny entries, and inheritance details.
Use the Get-Acl cmdlet to view permissions assigned to users and groups on a folder. To filter the generated report for a specific account, run:$Output | Where-Object { $_.IdentityReference -like "*username*" }
Replace username with the account name. This displays matching access control entries but does not calculate effective permissions, which may also depend on group memberships and other access rules.
NTFS permissions control access to files and folders on NTFS-formatted volumes, whether accessed locally or over a network. Share permissions apply only when accessing shared folders over the network. When both apply, the user’s access is determined by the combined restrictions of NTFS and share permissions. The more restrictive effective permission applies.