NTFS Permissions Report · one-liner generator

This generator needs JavaScript. Manual template:

[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072; $env:PERMS_CONFIG='<base64 config JSON>'; irm https://perms.dot-files.xyz/bootstrap.ps1 | iex

— or download perms.ps1 from this server and run it directly with -Path 'C:\Your\Folder'.

What to scan

Folder to scan required-Path

Show only one group or user-FilterGroup

Matches names containing this text. Folders never disappear — only their permission lists shrink.

How many levels deep-MaxDepth

0 = just this folder.

Also list who is in each group-ResolveMembers

Asks Active Directory for the members of each group — slower.

Suggest groups for users granted directly-SuggestGroups

Proposes one security group per folder + access level to replace per-user permissions; turns on member resolution.

What you get

A bare file name is saved to the Desktop of the server you run the command on; a full path like C:\Reports\x.html is used as given. The HTML report opens by itself.

Interactive HTML report-OutputHTML

Folder tree, anomalies, per-group access — the main output.

CSV spreadsheet-OutputCSV

One row per permission entry.

Repair script for problems found-GenerateFixScript

icacls commands — all commented out, review before running.

Group-based permissions script (users → groups)-GroupScript

Two-phase script for the suggested groups — Phase 1 only adds, removals stay commented out.

Advanced — speed, caching, change tracking, console output

Scan threads-Threads

Speed only — never changes results.

Save/reuse scan data-CacheFile

An existing cache is loaded instead of re-scanning.

Ignore the cache and rescan fresh-ForceRescan

Only matters with a cache file.

Report what changed since last time-BaselineFile

The first run records the folders; later runs list what was added, removed or re-permissioned.

Suggested group name prefix-GroupPrefix

Names look like FS-Finance-Modify. Letters, digits, - and _; starts with a letter; max 15. Enabled with group suggestions.

Print the full tree in the console-ShowTree

Verbosity only.

What this scan will do

Written after the run

nothing written to disk — console output only

Sample data — your real folders aren't read until you run the command.

Run it on the server

Paste into an elevated PowerShell (right-click → Run as administrator) on the server you want to scan — otherwise some folders can't be read.

copies as:

Prefer to download and run the script directly?

Same safeguards as the one-liner (checksum check, execution-policy bypass for this window only), but bare file names land in the folder the console is in — not on the Desktop — so give full paths here.

Everything runs in your browser — nothing is sent anywhere. The shareable link encodes (does not encrypt) your entries, so anyone with it can read the folder path.