There are a couple of ways this can be done. The two ways that I will
discuss are 1) Permissions on files (ACLs) and 2) User Rights.
The first is easier to accomplish, but requires you to run a script or
program on each server that the user has permissions. The program is
included in the Windows 2000 Resource Kit, and is called showacls. If you
run this program on the root of the hard drive, you can get a list of
permissions that have been assigned to this user directly on every resource
on the drive. You would need to perform this on each drive in each server.
Showacls is not available for download. Additionally there is a tool in
the resource kit that is also available for download at:
http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/perms-o.
asp.
Both of these tools are command line tools.
Determining user rights on a server is a bit more complex. An example
script is located on the Microsoft TechNet website at:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/ScriptCen
ter/user/ScrUG128.asp
that will allow you to read the security permissions for a user account.
This script shows how to script the extraction of the Discretionary Access
Control Lists (DACL) for a specific user.
Hope this helps.
David Waldron
MCSE+I, MCP+I, MCDBA, MCSA, MCT
Microsoft Enterprise Support
EPS Directory Services Team
(e-mail address removed)
