AccessChk - Windows Sysinternals

AccessChk is a command-line tool for viewing the effective permissions on files, registry keys, services, processes,

kernel objects, and more.

As a part of ensuring that they've created a secure environment Windows administrators often need to know what kind of

accesses specific users or groups have to resources including files, directories, Registry keys, global objects and

Windows services. AccessChk quickly answers these questions with an intuitive interface and output.

Usage: `accesschk [-s][-e][-u][-r][-w][-n][-v]-[f ,...][[-a]|[-k]|[-p [-f] [-t]]|[-h][-o [-t ]][-c]|[-d]] [[-l [-i]]|[username]] `

Parameter | Description

:--------:|------------

-a | Name is a Windows account right. Specify "*" as the name to show all rights assigned to a user. Note that when you specify a specific right, only groups and accounts directly assigned to the right are displayed.

-c | Name is a Windows Service, e.g. ssdpsrv. Specify "*" as the name to show all services and "scmanager" to check the security of the Service Control Manager.

-d | Only process directories or top-level keys

-e | Only show explicitly set-Integrity Levels (Windows Vista and higher only)

-f | If following -p, shows full process token information including groups and privileges. Otherwise is a list of comma-separated accounts to filter from the output.

-h | Name is a file or printer share. Specify '*' as the name to show all shares.

-i | Ignore objects with only inherited ACEs when dumping full access control lists.

-k | Name is a Registry key, e.g. hklm\software

-l | PShow full security descriptor. Add -i to ignore inherited ACEs.

-n | Show only objects that have no access

-o | Name is an object in the Object Manager namespace (default is root). To view the contents of a directory, specify the name with a trailing backslash or add -s. Add -t and an object type (e.g. section) to see only objects of a specific type.

-p | Name is a process name or PID, e.g. cmd.exe (specify "*" as the name to show all processes). Add -f to show full process token information, including groups and privileges. Add -t to show threads