User permissions in AD 2003

Some of my users don't have a checkbox "Allow inheritable permissions
from the parent to propagate to this object and all child objects.
Include these with entries explicitly defined here" checked under
security tab in Active Directory.

Is there a way to generate a list of all users who DON’T have that
checkbox checked?
Is there a way to check the box using a script?
Thank you

Howdie!

Fantômas schrieb:
> Some of my users don't have a checkbox "Allow inheritable permissions
> from the parent to propagate to this object and all child objects.
> Include these with entries explicitly defined here" checked under
> security tab in Active Directory.
>
> Is there a way to generate a list of all users who DON’T have that
> checkbox checked?
> Is there a way to check the box using a script?

Yeah - dsacls can do that. Check the /i and /p switches for this. I
wouldn't care about querying all objects whether they have inheritance
set or not - if they're supposed to apply inherited permission, I'd
simply run a script to set it and catch them all.

Cheers,
Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
ANY advice you get on the Newsgroups should be tested thoroughly in your
lab.

could someone post a sample of dsacls usage to pull the info i need?


Florian Frommherz [MVP] wrote:

> Howdie!
>
> Fantômas schrieb:
> > Some of my users don't have a checkbox "Allow inheritable
> > permissions from the parent to propagate to this object and all
> > child objects. Include these with entries explicitly defined here"
> > checked under security tab in Active Directory.
> >
> > Is there a way to generate a list of all users who DON’T have that
> > checkbox checked?
> > Is there a way to check the box using a script?
>
> Yeah - dsacls can do that. Check the /i and /p switches for this. I
> wouldn't care about querying all objects whether they have
> inheritance set or not - if they're supposed to apply inherited
> permission, I'd simply run a script to set it and catch them all.
>
> Cheers,
> Florian



--