SERVER-015 · Script
Audit NTFS Permissions
Reviews folder permissions on file shares and flags broad write access, per-user entries, unknown accounts and broken inheritance.
Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing
What it does
Walks each folder you list, down to -Depth levels, and reports:
- Broad write: Everyone, Authenticated Users, Users or Domain Users can change or delete files
- Per-user entry: a permission granted directly to a person rather than a group
Unknown account a permission for an account that no longer exists (shown only as a SID) Inheritance off the folder does not take permissions from its parent Only explicit (non-inherited) entries are judged, so each problem is reported once, where it was set. Files are not checked, only folders. Read-only; changes nothing.
Requirements
Windows PowerShell 5.1. Rights to read permissions on the folders (run as an administrator of the file server).
How to run it
- Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
- Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
- Script type: PowerShell 5.1, 64-bit
- User interaction: none; the script never prompts
- Timeout: 30 minutes for large directories or many servers
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Path | Folders to check, for example D:\Shares or \\fs01\Staff. | (none) | |
| Depth | How many folder levels below each path to check. Default: 3. 0 checks only the folders listed. | 3 | |
| SkipUserCheck | Do not look up whether each account is a user or a group (faster, and no directory lookups). | False | |
| AlertOn | Issues (default) exits 1 when anything is flagged. Never always exits 0. | Issues, Never | Issues |
Exit codes
- 0 = Nothing flagged (or AlertOn is Never)
- 1 = Issues found
- 2 = Script error (see log)
Testing steps
- Run it on one test OU, test account or test server and check the output and log.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report only. Nothing is changed, so nothing needs to be rolled back.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |