Current NTFS ACEs Without Inheritance

Current NTFS ACEs Without Inheritance

Details

Summary

How when using the srs.current_ntfs_aces view can I report on the ACEs without inheritance?

Explaination

The srs.current_ntfs_aces view includes a field called ace_flags which is a value mask.

If the bit flag with a value of 16 is present, then the ACE is inherited. Filtering out inherited ACEs is a simple matter of checking that this flag is off.

Code
 SELECT * FROM srs.current_ntfs_aces WHERE ace_flags & 16 <> 16 
Author
rlagger
Last modified
Saturday, January 8, 2022 - 14:05
Properties
Supported Version
Report Category
Includes a Report Layout
Yes
Downloads
Sample Report
Preview Images