| Author | Messages | |
mark.parris@xxxx.yyy
 | | 08/30/2005 11:22 AM |
| Hi,
What utility can I use to list the entire OU structure for a Domain and all permissions set on each OU?
I can manage to do it for a single OU but not say set it to DC=X,DC=Y and dump the whole structure.
Regards
Mark
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ | | | |
| kamleshap
Posts:27
| | 08/30/2005 8:06 AM |
| combination of dsquery ou and dsacls.exe should help you, currently I
dont have access to DC to give you the exact syntex.
But, I have a batch job running with DSACLS, every weekend to list
down the ACLS on each and every OU in domain. it saves individual
files for each OU.
something like,
for /F "Tokens=1* Delims=*" %A in ('dsquery ou') do dsacls %A > "%A".log
This will first create a list of all OU's and supply it to dsacls.exe
as input, whose output i.e. actual ACLS will be stored in the text
file with name as OU.
On 8/30/05, Mark Parris wrote:
> Hi,
>
> What utility can I use to list the entire OU structure for a Domain and all permissions set on each OU?
>
> I can manage to do it for a single OU but not say set it to DC=X,DC=Y and dump the whole structure.
>
> Regards
>
> Mark
> List info : http://www.activedir.org/List.aspx
> List FAQ : http://www.activedir.org/ListFAQ.aspx
> List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
>
--
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Fortune and Love befriend the bold"
~~~~~~~~~~~~~~~~~~~~~~~~~~~
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ | | | |
| mark.parris@xxxx.yyy
| | 08/31/2005 5:29 AM |
| DSACLS, but it would be nice for the whole tree.
Mark
-----Original Message-----
From: "Al Mulnick"
Date: Tue, 30 Aug 2005 20:19:03
To:
Subject: RE: [ActiveDir] Active Directory Permissions
What are you using now for that single OU?
-----Original Message-----
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark Parris
Sent: Tuesday, August 30, 2005 7:21 AM
To: ActiveDir.org
Subject: [ActiveDir] Active Directory Permissions
Hi,
What utility can I use to list the entire OU structure for a Domain and
all permissions set on each OU?
I can manage to do it for a single OU but not say set it to DC=X,DC=Y
and dump the whole structure.
Regards
Mark
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ | | | |
| Alm@xxxx.yyy
| | 08/31/2005 6:00 AM |
| ________________________________
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx on behalf of Mark Parris
Sent: Wed 8/31/2005 1:28 PM
To: ActiveDir.org
Subject: Re: [ActiveDir] Active Directory Permissions
DSACLS, but it would be nice for the whole tree.
Mark
-----Original Message-----
From: "Al Mulnick"
Date: Tue, 30 Aug 2005 20:19:03
To:
Subject: RE: [ActiveDir] Active Directory Permissions
What are you using now for that single OU?
-----Original Message-----
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark Parris
Sent: Tuesday, August 30, 2005 7:21 AM
To: ActiveDir.org
Subject: [ActiveDir] Active Directory Permissions
Hi,
What utility can I use to list the entire OU structure for a Domain and
all permissions set on each OU?
I can manage to do it for a single OU but not say set it to DC=X,DC=Y
and dump the whole structure.
Regards
Mark
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
> | | | |
| mark.parris@xxxx.yyy
| | 08/31/2005 6:12 AM |
| Many thanks.
Mark
_____
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Al Mulnick
Sent: 31 August 2005 17:58
To: ActiveDir@xxxxxxxxxxxxxxxxxx
Subject: RE: [ActiveDir] Active Directory Permissions
when you run it, use a command file.
dsacls ou1....
dsacls ou2....
dsacls ou3....
That of course would not get the sub OU's, but if they are relatively
static, it would be fast to put together and it would keep your output
fairly constant with what you have now.
If not, you could root around on joeware.net and see if there is something
there (note: I could really use a t-shirt to help me remember about joeware
tools when I reply to these :) or you could write a script. You could even
use something like a script that gathers the OU and then shells to dsacls or
something that stays script only. The list goes on.
Do you have a preference on the approach?
Al
_____
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx on behalf of Mark Parris
Sent: Wed 8/31/2005 1:28 PM
To: ActiveDir.org
Subject: Re: [ActiveDir] Active Directory Permissions
DSACLS, but it would be nice for the whole tree.
Mark
-----Original Message-----
From: "Al Mulnick"
Date: Tue, 30 Aug 2005 20:19:03
To:
Subject: RE: [ActiveDir] Active Directory Permissions
What are you using now for that single OU?
-----Original Message-----
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark Parris
Sent: Tuesday, August 30, 2005 7:21 AM
To: ActiveDir.org
Subject: [ActiveDir] Active Directory Permissions
Hi,
What utility can I use to list the entire OU structure for a Domain and
all permissions set on each OU?
I can manage to do it for a single OU but not say set it to DC=X,DC=Y
and dump the whole structure.
Regards
Mark
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
> | | | |
| AD000001012
Posts:0
| | 08/31/2005 11:06 AM |
| Hi Mark,
When writing our book (Inside Active Directory), I wrote a
script that dumps all the ACEs of a domain to an Excel
spreadsheet.
The script has some fixed names and it's not "production
quality" by any means, but if you want, I can e-mail it to
you.
Or, if another person on the list asks, I can also
put it on http://www.kouti.com
Yours, Sakari
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark
ParrisSent: Wednesday, August 31, 2005 9:08 PMTo:
ActiveDir@xxxxxxxxxxxxxxxxxxSubject: RE: [ActiveDir] Active
Directory Permissions
My preference is a
tool that does it for me “ but I will put together a script now that I know
there is not a tool to do it.
Many
thanks.
Mark
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx]
On Behalf Of Al
MulnickSent: 31 August 2005
17:58To: ActiveDir@xxxxxxxxxxxxxxxxxxSubject: RE: [ActiveDir] Active Directory
Permissions
when you run it, use
a command file.
dsacls
ou1....
dsacls
ou2....
dsacls
ou3....
That of course would not get the
sub OU's, but if they are relatively static, it would be fast to put together
and it would keep your output fairly constant with what you have now.
If not, you could root around on
joeware.net and see if there is something there (note: I could really use a
t-shirt to help me remember about joeware tools when I reply to these :) or
you could write a script. You could even use something like a script that
gathers the OU and then shells to dsacls or something that stays script only.
The list goes on.
Do you have a preference on the
approach?
Al
From:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx on
behalf of Mark ParrisSent:
Wed 8/31/2005 1:28 PMTo:
ActiveDir.orgSubject: Re:
[ActiveDir] Active Directory Permissions
DSACLS,
but it would be nice for the whole tree.Mark-----Original
Message-----From: "Al Mulnick" Date: Tue,
30 Aug 2005 20:19:03To:ActiveDir@xxxxxxxxxxxxxxxxxx>Subject: RE:
[ActiveDir] Active Directory PermissionsWhat are you using now for
that single OU?-----Original Message-----From:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx]
On Behalf Of Mark ParrisSent: Tuesday, August 30, 2005 7:21 AMTo:
ActiveDir.orgSubject: [ActiveDir] Active Directory
PermissionsHi,What utility can I use to list the entire OU
structure for a Domain andall permissions set on each OU?I can
manage to do it for a single OU but not say set it to DC=X,DC=Yand dump
the whole structure.RegardsMarkList info : http://www.activedir.org/List.aspxList
FAQ : http://www.activedir.org/ListFAQ.aspxList
archive:http://www.mail-archive.com/activedir%40mail.activedir.org/List
info : http://www.activedir.org/List.aspxList
FAQ : http://www.activedir.org/ListFAQ.aspxList
archive: http://www.mail-archive.com/activedir%40mail.activedir.org/List
info : http://www.activedir.org/List.aspxList
FAQ : http://www.activedir.org/ListFAQ.aspxList
archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ | | | |
| Alm@xxxx.yyy
| | 08/31/2005 12:17 PM |
| What are you using now for that single OU?
-----Original Message-----
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark Parris
Sent: Tuesday, August 30, 2005 7:21 AM
To: ActiveDir.org
Subject: [ActiveDir] Active Directory Permissions
Hi,
What utility can I use to list the entire OU structure for a Domain and
all permissions set on each OU?
I can manage to do it for a single OU but not say set it to DC=X,DC=Y
and dump the whole structure.
Regards
Mark
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ | | | |
| ArthurKitchens
Posts:2
| | 09/01/2005 1:09 AM |
| i would be very interested such
a script
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Sakari
KoutiSent: Wednesday, August 31, 2005 7:04 PMTo:
ActiveDir@xxxxxxxxxxxxxxxxxxSubject: RE: [ActiveDir] Active Directory
Permissions
Hi Mark,
When writing our book (Inside Active Directory), I wrote a
script that dumps all the ACEs of a domain to an Excel
spreadsheet.
The script has some fixed names and it's not "production
quality" by any means, but if you want, I can e-mail it to
you.
Or, if another person on the list asks, I can also
put it on http://www.kouti.com
Yours, Sakari
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark
ParrisSent: Wednesday, August 31, 2005 9:08 PMTo:
ActiveDir@xxxxxxxxxxxxxxxxxxSubject: RE: [ActiveDir] Active
Directory Permissions
My preference is a
tool that does it for me - but I will put together a script now that I know
there is not a tool to do it.
Many
thanks.
Mark
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx]
On Behalf Of Al
MulnickSent: 31 August 2005
17:58To: ActiveDir@xxxxxxxxxxxxxxxxxxSubject: RE: [ActiveDir] Active Directory
Permissions
when you run it, use
a command file.
dsacls
ou1....
dsacls
ou2....
dsacls
ou3....
That of course would not get the
sub OU's, but if they are relatively static, it would be fast to put together
and it would keep your output fairly constant with what you have now.
If not, you could root around on
joeware.net and see if there is something there (note: I could really use a
t-shirt to help me remember about joeware tools when I reply to these :) or
you could write a script. You could even use something like a script that
gathers the OU and then shells to dsacls or something that stays script only.
The list goes on.
Do you have a preference on the
approach?
Al
From:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx on
behalf of Mark ParrisSent:
Wed 8/31/2005 1:28 PMTo:
ActiveDir.orgSubject: Re:
[ActiveDir] Active Directory Permissions
DSACLS,
but it would be nice for the whole tree.Mark-----Original
Message-----From: "Al Mulnick" Date: Tue,
30 Aug 2005 20:19:03To:ActiveDir@xxxxxxxxxxxxxxxxxx>Subject: RE:
[ActiveDir] Active Directory PermissionsWhat are you using now for
that single OU?-----Original Message-----From:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx]
On Behalf Of Mark ParrisSent: Tuesday, August 30, 2005 7:21 AMTo:
ActiveDir.orgSubject: [ActiveDir] Active Directory
PermissionsHi,What utility can I use to list the entire OU
structure for a Domain andall permissions set on each OU?I can
manage to do it for a single OU but not say set it to DC=X,DC=Yand dump
the whole structure.RegardsMarkList info : http://www.activedir.org/List.aspxList
FAQ : http://www.activedir.org/ListFAQ.aspxList
archive:http://www.mail-archive.com/activedir%40mail.activedir.org/List
info : http://www.activedir.org/List.aspxList
FAQ : http://www.activedir.org/ListFAQ.aspxList
archive: http://www.mail-archive.com/activedir%40mail.activedir.org/List
info : http://www.activedir.org/List.aspxList
FAQ : http://www.activedir.org/ListFAQ.aspxList
archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ | | | |
| jmedeiros@xxxx.yyy
| | 09/01/2005 5:17 AM |
| If you don't mind .. I would like a copy as well.
Thank you in advance.
Jose Medeiros
http://www.sjpc.org/~medeiros
MCP+I, MCSE, NT4 MCT
----------------------------------------------------
-----Original Message-----
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx]On Behalf Of Mark Parris
Sent: Wednesday, August 31, 2005 10:41 PM
To: ActiveDir.org
Subject: Re: [ActiveDir] Active Directory Permissions
I will take a copy of this script please and I will also utilise the other script posted,
Markp
-----Original Message-----
From: "Sakari Kouti"
Date: Thu, 1 Sep 2005 02:04:21
To:
Subject: RE: [ActiveDir] Active Directory Permissions
Hi Mark,
When writing our book (Inside Active Directory), I wrote a script that dumps all the ACEs of a domain to an Excel spreadsheet.
The script has some fixed names and it's not "production quality" by any means, but if you want, I can e-mail it to you.
Or, if another person on the list asks, I can also put it on http://www.kouti.com
Yours, Sakari
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark Parris
Sent: Wednesday, August 31, 2005 9:08 PM
To: ActiveDir@xxxxxxxxxxxxxxxxxx
Subject: RE: [ActiveDir] Active Directory Permissions
My preference is a tool that does it for me but I will put together a script now that I know there is not a tool to do it.
Many thanks.
Mark
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Al Mulnick
Sent: 31 August 2005 17:58
To: ActiveDir@xxxxxxxxxxxxxxxxxx
Subject: RE: [ActiveDir] Active Directory Permissions
when you run it, use a command file.
dsacls ou1....
dsacls ou2....
dsacls ou3....
That of course would not get the sub OU's, but if they are relatively static, it would be fast to put together and it would keep your output fairly constant with what you have now.
If not, you could root around on joeware.net and see if there is something there (note: I could really use a t-shirt to help me remember about joeware tools when I reply to these :) or you could write a script. You could even use something like a script that gathers the OU and then shells to dsacls or something that stays script only. The list goes on.
Do you have a preference on the approach?
Al
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx on behalf of Mark Parris
Sent: Wed 8/31/2005 1:28 PM
To: ActiveDir.org
Subject: Re: [ActiveDir] Active Directory Permissions
DSACLS, but it would be nice for the whole tree.
Mark
-----Original Message-----
From: "Al Mulnick"
Date: Tue, 30 Aug 2005 20:19:03
To:
Subject: RE: [ActiveDir] Active Directory Permissions
What are you using now for that single OU?
-----Original Message-----
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark Parris
Sent: Tuesday, August 30, 2005 7:21 AM
To: ActiveDir.org
Subject: [ActiveDir] Active Directory Permissions
Hi,
What utility can I use to list the entire OU structure for a Domain and
all permissions set on each OU?
I can manage to do it for a single OU but not say set it to DC=X,DC=Y
and dump the whole structure.
Regards
Mark
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ | | | |
| kamleshap
Posts:27
| | 09/01/2005 5:23 AM |
| I had already posted the recursive command for DSACLS to dump the full
structure...
Here it goes again.. Put it in a batch file....
For /F "Tokens=1* Delims=*" %%A in ('dsquery ou -limit 0') do dsacls
%%A > %%A.log
This will recursive go to each OU and dump its permissions in logfile
named by the OU.
On 9/1/05, Sakari Kouti wrote:
> Hi Mark,
>
> When writing our book (Inside Active Directory), I wrote a script that dumps
> all the ACEs of a domain to an Excel spreadsheet.
>
> The script has some fixed names and it's not "production quality" by any
> means, but if you want, I can e-mail it to you.
>
> Or, if another person on the list asks, I can also put it on
> http://www.kouti.com
>
> Yours, Sakari
>
>
>
> ________________________________
> From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
> [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of
> Mark Parris
> Sent: Wednesday, August 31, 2005 9:08 PM
>
> To: ActiveDir@xxxxxxxxxxxxxxxxxx
> Subject: RE: [ActiveDir] Active Directory Permissions
>
>
>
>
> My preference is a tool that does it for me “ but I will put together a
> script now that I know there is not a tool to do it.
>
>
>
> Many thanks.
>
>
>
> Mark
>
>
> ________________________________
>
>
> From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
> [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Al
> Mulnick
> Sent: 31 August 2005 17:58
> To: ActiveDir@xxxxxxxxxxxxxxxxxx
> Subject: RE: [ActiveDir] Active Directory Permissions
>
>
>
>
> when you run it, use a command file.
>
>
>
>
>
> dsacls ou1....
>
>
> dsacls ou2....
>
>
> dsacls ou3....
>
>
>
>
>
> That of course would not get the sub OU's, but if they are relatively
> static, it would be fast to put together and it would keep your output
> fairly constant with what you have now.
>
>
>
>
>
> If not, you could root around on joeware.net and see if there is something
> there (note: I could really use a t-shirt to help me remember about joeware
> tools when I reply to these :) or you could write a script. You could even
> use something like a script that gathers the OU and then shells to dsacls or
> something that stays script only. The list goes on.
>
>
>
>
>
> Do you have a preference on the approach?
>
>
>
>
>
> Al
>
>
>
> ________________________________
>
>
> From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx on behalf of Mark
> Parris
> Sent: Wed 8/31/2005 1:28 PM
> To: ActiveDir.org
> Subject: Re: [ActiveDir] Active Directory Permissions
>
>
> DSACLS, but it would be nice for the whole tree.
>
> Mark
> -----Original Message-----
> From: "Al Mulnick"
> Date: Tue, 30 Aug 2005 20:19:03
> To:
> Subject: RE: [ActiveDir] Active Directory Permissions
>
> What are you using now for that single OU?
>
>
>
> -----Original Message-----
> From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
> [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of
> Mark Parris
> Sent: Tuesday, August 30, 2005 7:21 AM
> To: ActiveDir.org
> Subject: [ActiveDir] Active Directory Permissions
>
> Hi,
>
> What utility can I use to list the entire OU structure for a Domain and
> all permissions set on each OU?
>
> I can manage to do it for a single OU but not say set it to DC=X,DC=Y
> and dump the whole structure.
>
> Regards
>
> Mark
> List info : http://www.activedir.org/List.aspx
> List FAQ : http://www.activedir.org/ListFAQ.aspx
> List archive:
> http://www.mail-archive.com/activedir%40mail.activedir.org/
> List info : http://www.activedir.org/List.aspx
> List FAQ : http://www.activedir.org/ListFAQ.aspx
> List archive:
> http://www.mail-archive.com/activedir%40mail.activedir.org/
>
> List info : http://www.activedir.org/List.aspx
> List FAQ : http://www.activedir.org/ListFAQ.aspx
> List archive:
> http://www.mail-archive.com/activedir%40mail.activedir.org/
--
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Fortune and Love befriend the bold"
~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | |
| mark.parris@xxxx.yyy
| | 09/01/2005 5:42 AM |
| I will take a copy of this script please and I will also utilise the other script posted,
Markp
-----Original Message-----
From: "Sakari Kouti"
Date: Thu, 1 Sep 2005 02:04:21
To:
Subject: RE: [ActiveDir] Active Directory Permissions
Hi Mark,
When writing our book (Inside Active Directory), I wrote a script that dumps all the ACEs of a domain to an Excel spreadsheet.
The script has some fixed names and it's not "production quality" by any means, but if you want, I can e-mail it to you.
Or, if another person on the list asks, I can also put it on http://www.kouti.com
Yours, Sakari
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark Parris
Sent: Wednesday, August 31, 2005 9:08 PM
To: ActiveDir@xxxxxxxxxxxxxxxxxx
Subject: RE: [ActiveDir] Active Directory Permissions
My preference is a tool that does it for me but I will put together a script now that I know there is not a tool to do it.
Many thanks.
Mark
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Al Mulnick
Sent: 31 August 2005 17:58
To: ActiveDir@xxxxxxxxxxxxxxxxxx
Subject: RE: [ActiveDir] Active Directory Permissions
when you run it, use a command file.
dsacls ou1....
dsacls ou2....
dsacls ou3....
That of course would not get the sub OU's, but if they are relatively static, it would be fast to put together and it would keep your output fairly constant with what you have now.
If not, you could root around on joeware.net and see if there is something there (note: I could really use a t-shirt to help me remember about joeware tools when I reply to these :) or you could write a script. You could even use something like a script that gathers the OU and then shells to dsacls or something that stays script only. The list goes on.
Do you have a preference on the approach?
Al
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx on behalf of Mark Parris
Sent: Wed 8/31/2005 1:28 PM
To: ActiveDir.org
Subject: Re: [ActiveDir] Active Directory Permissions
DSACLS, but it would be nice for the whole tree.
Mark
-----Original Message-----
From: "Al Mulnick"
Date: Tue, 30 Aug 2005 20:19:03
To:
Subject: RE: [ActiveDir] Active Directory Permissions
What are you using now for that single OU?
-----Original Message-----
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark Parris
Sent: Tuesday, August 30, 2005 7:21 AM
To: ActiveDir.org
Subject: [ActiveDir] Active Directory Permissions
Hi,
What utility can I use to list the entire OU structure for a Domain and
all permissions set on each OU?
I can manage to do it for a single OU but not say set it to DC=X,DC=Y
and dump the whole structure.
Regards
Mark
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ | | | |
| dwells
Posts:39
| | 09/02/2005 1:28 AM |
| Is
anyone else receiving blank posts, per the enclosed, or occasional
dupes?
--Dean WellsMSEtechnology* Email: dwells@msetechnology.comhttp://msetechnology.com
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Michael B.
SmithSent: Thursday, September 01, 2005 8:52 PMTo:
ActiveDir@xxxxxxxxxxxxxxxxxxCc:
Sakari.Kouti@xxxxxxxxxxSubject: RE: [ActiveDir] Active Directory
Permissions | | | |
| hunter@xxxx.yyy
| | 09/02/2005 1:34 AM |
| Negative on the blanks, but yes to the occasional dupe. I thought I
remembered Tony saying that he was aware of it, but I don't remember if
he mentioned any sort of resolution.
- Laura
> -----Original Message-----
> From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
> [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Dean Wells
> Sent: Thursday, September 01, 2005 9:28 PM
> To: Send - AD mailing list
> Subject: RE: [ActiveDir] Active Directory Permissions
>
> Is anyone else receiving blank posts, per the enclosed, or
> occasional dupes?
> --
> Dean Wells
> MSEtechnology
> * Email: dwells@xxxxxxxxxxxxxxxxx
> http://msetechnology.com
>
>
>
> ________________________________
>
> From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
> [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of
> Michael B. Smith
> Sent: Thursday, September 01, 2005 8:52 PM
> To: ActiveDir@xxxxxxxxxxxxxxxxxx
> Cc: Sakari.Kouti@xxxxxxxxxx
> Subject: RE: [ActiveDir] Active Directory Permissions
>
>
>
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ | | | |
| bdesmond
Posts:416
| | 09/02/2005 1:48 AM |
| No blanks, dupes stopped for me one day.
Thanks,
Brian
Desmond
brian@xxxxxxxxxxxxxxxx
c -
312.731.3132
From:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Dean Wells
Sent: Thursday, September 01, 2005
9:28 PM
To: Send - AD mailing list
Subject: RE: [ActiveDir] Active
Directory Permissions
Is anyone else receiving blank posts, per
the enclosed, or occasional dupes?
--
Dean Wells
MSEtechnology
* Email: dwells@xxxxxxxxxxxxxxxxx
http://msetechnology.com
From:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Michael B. Smith
Sent: Thursday, September 01, 2005
8:52 PM
To: ActiveDir@xxxxxxxxxxxxxxxxxx
Cc: Sakari.Kouti@xxxxxxxxxx
Subject: RE: [ActiveDir] Active
Directory Permissions | | | |
| listmail
Posts:497
| | 09/02/2005 3:36 AM |
| Michael Smith's last post with this title showed up as
blank for me.
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Dean
WellsSent: Thursday, September 01, 2005 9:28 PMTo: Send -
AD mailing listSubject: RE: [ActiveDir] Active Directory
Permissions
Is
anyone else receiving blank posts, per the enclosed, or occasional
dupes?
--Dean WellsMSEtechnology* Email: dwells@msetechnology.comhttp://msetechnology.com
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Michael B.
SmithSent: Thursday, September 01, 2005 8:52 PMTo:
ActiveDir@xxxxxxxxxxxxxxxxxxCc:
Sakari.Kouti@xxxxxxxxxxSubject: RE: [ActiveDir] Active Directory
Permissions | | | |
| AD00000264
Posts:0
| | 09/02/2005 6:34 AM |
| Whoa...I first read that as "I've also started to get replies to messages
I haven't sent yet..." I know the folks on this list are
good, but not that good...:)
Dave
-----Original Message-----From:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx]
On Behalf Of Phil RenoufSent: Friday, September 02, 2005
7:35 AMTo: ActiveDir@xxxxxxxxxxxxxxxxxxSubject: Re:
[ActiveDir] Active Directory Permissions
Yeah I see occasional blanks and dupes as well. None for a couple of
days, but it happens. I've also started to get replies to messages I haven't
seen yet, then a few hours later the original message shows up.
Phil
On 9/2/05, Rocky
Habeeb
wrote:
Dean,
>Every_____________________________________
-----Original Message-----From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of
Dean WellsSent: Thursday, September 01, 2005 9:28
PMTo: Send - AD mailing listSubject: RE: [ActiveDir] Active Directory
Permissions
Is anyone else receiving
blank posts, per the enclosed, or occasional
dupes?
--Dean
WellsMSEtechnology* Email: dwells@msetechnology.comhttp://msetechnology.com
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Michael B.
SmithSent: Thursday, September 01, 2005 8:52 PMTo:
ActiveDir@xxxxxxxxxxxxxxxxxxCc: Sakari.Kouti@xxxxxxxxxxSubject: RE:
[ActiveDir] Active Directory Permissions
| | | |
| prenouf
Posts:1
| | 09/02/2005 6:58 AM |
| Whoa...I first read that as "I've also started to get replies to messages I haven't sent yet..." I know the folks on this list are good, but not
that good...:)
Dave
-----Original Message-----From:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of
Phil RenoufSent: Friday, September 02, 2005 7:35 AMTo: ActiveDir@xxxxxxxxxxxxxxxxxx
Subject: Re: [ActiveDir] Active Directory Permissions
Yeah I see occasional blanks and dupes as well. None for a couple of days, but it happens. I've also started to get replies to messages I haven't seen yet, then a few hours later the original message shows up.
Phil
On 9/2/05, Rocky Habeeb wrote:
Dean,
>Every< post from Brett Shirley is a dupe to me.
RH
_____________________________________
-----Original Message-----From:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of
Dean WellsSent: Thursday, September 01, 2005 9:28 PMTo: Send - AD mailing listSubject: RE: [ActiveDir] Active Directory Permissions
Is anyone else receiving blank posts, per the enclosed, or occasional dupes?
--
Dean WellsMSEtechnology
* Email:
dwells@msetechnology.com
http://msetechnology.com
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Michael B. SmithSent: Thursday, September 01, 2005 8:52 PMTo:
ActiveDir@xxxxxxxxxxxxxxxxxxCc: Sakari.Kouti@xxxxxxxxxxSubject: RE: [ActiveDir] Active Directory Permissions | | | |
| habr
Posts:26
| | 09/02/2005 12:27 PM |
| Dean,
>Every
RH
_____________________________________
-----Original Message-----From:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx]
On Behalf Of Dean WellsSent: Thursday, September 01, 2005
9:28 PMTo: Send - AD mailing listSubject: RE:
[ActiveDir] Active Directory Permissions
Is
anyone else receiving blank posts, per the enclosed, or occasional
dupes?
--Dean
WellsMSEtechnology* Email: dwells@msetechnology.comhttp://msetechnology.com
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
[mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Michael B.
SmithSent: Thursday, September 01, 2005 8:52 PMTo:
ActiveDir@xxxxxxxxxxxxxxxxxxCc:
Sakari.Kouti@xxxxxxxxxxSubject: RE: [ActiveDir] Active Directory
Permissions | | | |
| prenouf
Posts:1
| | 09/02/2005 12:36 PM |
| Dean,
>Every< post from Brett Shirley is a dupe to me.
RH
_____________________________________
-----Original Message-----From:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of
Dean WellsSent: Thursday, September 01, 2005 9:28 PMTo: Send - AD mailing listSubject: RE: [ActiveDir] Active Directory Permissions
Is anyone else receiving blank posts, per the enclosed, or occasional dupes?
--
Dean WellsMSEtechnology
* Email:
dwells@msetechnology.com
http://msetechnology.com
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:
ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Michael B. SmithSent: Thursday, September 01, 2005 8:52 PMTo:
ActiveDir@xxxxxxxxxxxxxxxxxxCc: Sakari.Kouti@xxxxxxxxxxSubject: RE: [ActiveDir] Active Directory Permissions | | | |
| michael@xxxx.yyy
| | 09/02/2005 12:54 PM |
| Sakari -
I'd like to see your script as well.
M
-----Original Message-----
From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Kamlesh Parmar
Sent: Thursday, September 01, 2005 1:22 AM
To: ActiveDir@xxxxxxxxxxxxxxxxxx
Subject: Re: [ActiveDir] Active Directory Permissions
I had already posted the recursive command for DSACLS to dump the full structure...
Here it goes again.. Put it in a batch file....
For /F "Tokens=1* Delims=*" %%A in ('dsquery ou -limit 0') do dsacls %%A > %%A.log
This will recursive go to each OU and dump its permissions in logfile named by the OU.
On 9/1/05, Sakari Kouti wrote:
> Hi Mark,
>
> When writing our book (Inside Active Directory), I wrote a script that
> dumps all the ACEs of a domain to an Excel spreadsheet.
>
> The script has some fixed names and it's not "production quality" by
> any means, but if you want, I can e-mail it to you.
>
> Or, if another person on the list asks, I can also put it on
> http://www.kouti.com
>
> Yours, Sakari
>
>
>
> ________________________________
> From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
> [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark Parris
> Sent: Wednesday, August 31, 2005 9:08 PM
>
> To: ActiveDir@xxxxxxxxxxxxxxxxxx
> Subject: RE: [ActiveDir] Active Directory Permissions
>
>
>
>
> My preference is a tool that does it for me “ but I will put together
> a script now that I know there is not a tool to do it.
>
>
>
> Many thanks.
>
>
>
> Mark
>
>
> ________________________________
>
>
> From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
> [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Al Mulnick
> Sent: 31 August 2005 17:58
> To: ActiveDir@xxxxxxxxxxxxxxxxxx
> Subject: RE: [ActiveDir] Active Directory Permissions
>
>
>
>
> when you run it, use a command file.
>
>
>
>
>
> dsacls ou1....
>
>
> dsacls ou2....
>
>
> dsacls ou3....
>
>
>
>
>
> That of course would not get the sub OU's, but if they are relatively
> static, it would be fast to put together and it would keep your output
> fairly constant with what you have now.
>
>
>
>
>
> If not, you could root around on joeware.net and see if there is
> something there (note: I could really use a t-shirt to help me
> remember about joeware tools when I reply to these :) or you could
> write a script. You could even use something like a script that
> gathers the OU and then shells to dsacls or something that stays script only. The list goes on.
>
>
>
>
>
> Do you have a preference on the approach?
>
>
>
>
>
> Al
>
>
>
> ________________________________
>
>
> From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx on behalf of Mark Parris
> Sent: Wed 8/31/2005 1:28 PM
> To: ActiveDir.org
> Subject: Re: [ActiveDir] Active Directory Permissions
>
>
> DSACLS, but it would be nice for the whole tree.
>
> Mark
> -----Original Message-----
> From: "Al Mulnick"
> Date: Tue, 30 Aug 2005 20:19:03
> To:
> Subject: RE: [ActiveDir] Active Directory Permissions
>
> What are you using now for that single OU?
>
>
>
> -----Original Message-----
> From: ActiveDir-owner@xxxxxxxxxxxxxxxxxx
> [mailto:ActiveDir-owner@xxxxxxxxxxxxxxxxxx] On Behalf Of Mark Parris
> Sent: Tuesday, August 30, 2005 7:21 AM
> To: ActiveDir.org
> Subject: [ActiveDir] Active Directory Permissions
>
> Hi,
>
> What utility can I use to list the entire OU structure for a Domain
> and all permissions set on each OU?
>
> I can manage to do it for a single OU but not say set it to DC=X,DC=Y
> and dump the whole structure.
>
> Regards
>
> Mark
> List info : http://www.activedir.org/List.aspx
> List FAQ : http://www.activedir.org/ListFAQ.aspx
> List archive:
> http://www.mail-archive.com/activedir%40mail.activedir.org/
> List info : http://www.activedir.org/List.aspx
> List FAQ : http://www.activedir.org/ListFAQ.aspx
> List archive:
> http://www.mail-archive.com/activedir%40mail.activedir.org/
>
> List info : http://www.activedir.org/List.aspx
> List FAQ : http://www.activedir.org/ListFAQ.aspx
> List archive:
> http://www.mail-archive.com/activedir%40mail.activedir.org/
--
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Fortune and Love befriend the bold"
~~~~~~~~~~~~~~~~~~~~~~~~~~~
.+Å w ÛÿüçŠ÷ŠºÆ’ò²Ã–§²Ã‘B§Ã¿Ãƒ¶+v*®Å ˧²Ã–rz§Ã¿Ãƒ Å VryÊý§Å ÷Š¾„¢¨i˽ç®Å | | | |
|
|