BigFix User Group

Here is one that will list shares in which the Everyone account is listed as a trustee:

q: names of it whose (exists (account name of trustee of entries of dacls of security descriptors of it) whose (it = "Everyone")) of network shares

This will list every share with Everyone assigned to it and their read, write, execute privileges respectively:

q: (name of it, (account name of trustee of it, read permissions of it, write permissions of it, execute permissions of it) of entries whose (account name of trustee of it = "Everyone") of dacls of security descriptors of it) of network shares

There are a lot of potential privileges that can be listed with this.

read permission of <access control entry>: boolean
list permission of <access control entry>: boolean
write permission of <access control entry>: boolean
create file permission of <access control entry>: boolean
append permission of <access control entry>: boolean
create folder permission of <access control entry>: boolean
read extended attributes permission of <access control entry>: boolean
write extended attributes permission of <access control entry>: boolean
execute permission of <access control entry>: boolean
traverse permission of <access control entry>: boolean
delete child permission of <access control entry>: boolean
read attributes permission of <access control entry>: boolean
write attributes permission of <access control entry>: boolean
query value permission of <access control entry>: boolean
set value permission of <access control entry>: boolean
create subkey permission of <access control entry>: boolean
enumerate subkeys permission of <access control entry>: boolean
change notification permission of <access control entry>: boolean
create link permission of <access control entry>: boolean
delete permission of <access control entry>: boolean
read control permission of <access control entry>: boolean
write dac permission of <access control entry>: boolean
write owner permission of <access control entry>: boolean
synchronize permission of <access control entry>: boolean
maximum allowed permission of <access control entry>: boolean
generic all permission of <access control entry>: boolean
generic execute permission of <access control entry>: boolean
generic write permission of <access control entry>: boolean
generic read permission of <access control entry>: boolean
access mode of <access control entry>: integer

I hate to bring a thread back from the dead, but this question seems to be the most applicable.  I am trying to see if a particular group has access to a folder.  Everything I have seen talks about "effective permissions" and while that works in most cases, we have some folks here who have been a bit too "generous" when applying permissions.  I am trying to lock things down, but I want to make sure my new groups are in place before that.

Anyway, this is what I have so far:

account names of trustees of (entries of dacls of security descriptors of it) of folder "c:\folder"

That lists all of the users/groups that have permissions.  I need something that will return true/false based on a group name being listed AND that it has write permissions.  I have been fiddling with this tonight, but haven't been able to get it working.  Thank you in advance for taking a stab at it.

Well, I am not interested in "effective permissions."  Like I said before, we had some folks who were a bit "generous" in granting permissions.  In other words, they liked to use "Everyone".  ::sigh::  Anyway, I ALMOST have something worked out for my fixlet applicability, but it is really ghetto and doesn't quite work.

substring separated by " " whose (it as lowercase contains "group") of account names of trustees of (entries whose (write permission of it = true) of dacls of security descriptors of it) of folder "c:\folder" as lowercase != "group"

It returns "false" when the group has write permission to the folder, but if the group is not there or does not have permission, it laughs at me and says "Singular expression refers to nonexistent object."  I need it to return true in that situation and I can't figure out how to guard it so it does.

Anyway, I would really appreciate it if someone has any ideas on how to guard the code as it is, or a better way to go about doing this.  Thanks.