Exporting NTFS permissions gives you a complete record of who has access to your files and folders. In this guide, I’ll show you how to export NTFS permissions to CSV using PowerShell and the NTFS Permissions Reporter included with the AD Pro Toolkit.
How to Export NTFS Permissions
To export NTFS permissions with PowerShell, you will need to use two commands, get-acl and get-childitem.
Step 1. Run the script below to get NTFS permissions on all folders. Change the path to match your file server.
Get-ChildItem "\\server\path" -Recurse -Force -Directory | ForEach-Object {
$acl = Get-Acl $_.FullName
$acl.Access | Where-Object { -not $_.IsInherited } | Select-Object `
@{N='Path'; E={ $acl.Path -replace '.*FileSystem::', '' }},
@{N='Identity'; E={ $_.IdentityReference }},
@{N='Rights'; E={ $_.FileSystemRights }},
@{N='Type'; E={ $_.AccessControlType }},
@{N='Inherited'; E={ $_.IsInherited }},
@{N='Propagation'; E={ $_.PropagationFlags }}
}
Step 2. To export the list of permissions, add export-csv to the script. Change the path to a location on your computer.
Get-ChildItem "\\server\path" -Recurse -Force -Directory | ForEach-Object {
$acl = Get-Acl $_.FullName
$acl.Access | Where-Object { -not $_.IsInherited } | Select-Object `
@{N='Path'; E={ $acl.Path -replace '.*FileSystem::', '' }},
@{N='Identity'; E={ $_.IdentityReference }},
@{N='Rights'; E={ $_.FileSystemRights }},
@{N='Type'; E={ $_.AccessControlType }},
@{N='Inherited'; E={ $_.IsInherited }},
@{N='Propagation'; E={ $_.PropagationFlags }}
} | Export-Csv -path "c:\it\ntfspermissions.csv" -NoTypeInformation
This will give you a csv file with a list of all the folders and permissions.
AD Pro Toolkit Method
The AD Pro Toolkit includes an NTFS Permissions Report Tool that makes it easy to get and export NTFS Permissions.
You can add multiple servers or folders to scan at once.
To export the permissions, click the export button and choose from CSV, Excel or PDF Format.
Example of NTFS Permissions exported to Excel.
Download Free Trial and export NTFS Permissions without complicated scripts.
Resources
- Get-Acl - Microsoft command documentation. This command was used to get a security descriptor from resources (folders in this guide).
- Get-Childitem - Microsoft command documentation. This is the command used to get subfolders.
