[gptalk] Reading apply permissions

  • From: "Maugris Beauchamps" <rmgmaug38xq@xxxxxxxxx>
  • To: gptalk@xxxxxxxxxxxxx
  • Date: Fri, 16 Feb 2007 15:23:44 -0800

When I look at the permissions of registry.pol using xcacls, it says a
particular group has read permissions, and indeed they do, but the
group also has Apply Group Policy permissions, which does not show up
in the file's acl at all.

When I look using GPMC, the group has the permissions listed as "Read
(from security filtering"

In the Delegation tab, they show as having Read and Apply.

Is there a command line utility or script that can show the applied
permissions to GPOs?

I would find this useful, because I have policies that apply
generally, but from some specific users, or some specific sub-groups,
I deny the apply permissions to exempt them from the policy's
application.  It would be nice to ensure that all is well before let
the policies go to work.

You can unsubscribe from gptalk by sending email to 
gptalk-request@xxxxxxxxxxxxx with 'unsubscribe' in the Subject field OR by 
logging into the freelists.org Web interface. Archives for the list are 
available at http://www.freelists.org/archives/gptalk/

Other related posts: