> For the complete documentation index, see [llms.txt](https://www.shellspells.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.shellspells.net/windows/system-ops/security/permissions/enumerate.md). # Enumerate ## File Permissions

Command	Description
`icacls <FilePath>`	Displays or modifies DACLs on specified files (CMD).
`cacls <FilePathOrDirectory>`	(Deprecated) Displays the ACL for files and directories.
`Get-Acl -Path <FilePathOrDirectory>`	Gets the ACL for a specific file or directory.

Displays a detailed list of ACL entries for a specific file or directory: ```powershell Get-Acl -Path | Format-List ``` Lists access rules for a file or directory: ```powershell Get-Acl -Path | Select-Object -ExpandProperty Access ``` Retrieves the ACL for all files and directories within a specified path recursively: ```powershell Get-ChildItem -Path -Recurse | Get-Acl ``` Retrieves file names, paths, and access masks (numeric representation of permissions): ```powershell wmic datafile where (Path='\') get Name, FileName, AccessMask ``` Displays permissions in a more concise format, listing each user or group and their corresponding permissions: {% code overflow="wrap" %} ```powershell Get-Acl -Path \ | Select-Object -ExpandProperty Access | ForEach-Object {$_.IdentityReference; $_.FileSystemRights} ``` {% endcode %} Leverages the AccessToString() method to directly convert access masks to human-readable permission strings. {% code overflow="wrap" %} ```powershell Get-Acl -Path \ | Select-Object -ExpandProperty Access | ForEach-Object { $_.IdentityReference; $_.FileSystemRights.ToString() } ``` {% endcode %} #### Understanding access masks: Numeric values represent permissions (e.g., 2032127 = Full Control). Use PowerShell's `Get-Acl` and `AccessToString` methods to convert them to human-readable format. Filtering by permission level: Use PowerShell's `Where-Object` cmdlet to filter based on access mask values or specific permissions. Tools for advanced analysis: Consider tools like AccessEnum or NTFS Permissions Reporter for detailed permission analysis and reporting. ## User Permissions

Command	Description
`whoami /priv`	Displays current user privileges.
`net user <username>`	Displays basic information about a user.
`Get-LocalUser`	Retrieves local user accounts.
`Get-LocalGroupMember <GroupName>`	Retrieves members of a local group.
`icacls <file_or_folder>`	Displays user permissions for a file or folder.
`Get-ADUser -Filter * -Properties *`	Retrieves user accounts from Active Directory.
`Get-ADGroupMember <GroupName>`	Retrieves members of an Active Directory group.

Retrieves information about a specific user: {% code overflow="wrap" %} ```powershell Get-WmiObject -Class Win32_UserAccount | Where-Object {$_.Name -eq ""} | Select-Object Name, FullName, Description ``` {% endcode %} ## Group Permissions

Command	Description
`Get-LocalGroup`	Retrieves local groups on a computer.
`Get-ADGroup -Filter * -Properties *`	Retrieves groups from Active Directory (requires AD module).
`Get-LocalGroupMember <GroupName>`	Retrieves members of a local group.
`Get-ADGroupMember <GroupName>`	Retrieves members of an Active Directory group (requires AD).
`net localgroup <group_name>`	Lists members of a local group without detailed permissions.
`icacls <file_or_folder>`	Displays permissions for a file or folder, including groups.
`whoami /groups`	Shows the groups to which the current user belongs.

## Share Permissions {% code overflow="wrap" %} ```powershell Get-WmiObject Win32_LogicalShareSecuritySetting `| Retrieves share permissions (PowerShell). ``` {% endcode %} Enumerates user permissions on a network share: {% code overflow="wrap" %} ```powershell Get-CimInstance -ClassName Win32_LogicalShareSecuritySetting | Where-Object {$_.Name -eq ""} | Get-CimAssociatedInstance -ResultClassName Win32_Ace | Select-Object Principal, AccessMask ``` {% endcode %} ## Sysinternals


`accesschk`	Shows file/dir permissions for the user.