Listing user privileges

Hi all, is there a simple utility I can use that will list all the
privileges a user has in a Windows 2000 environment?

A service I've develeoped is getting a failure to create a file on one
user's disk drive but not on another drive in the same system. The problem
is not fixed by granting the user that runs the service full access to the
base directory, but it is fixed by adding the user that runs the service to
the Domain Admins group.

I figure the only way to diagnose this is to work out what the privilege
difference between the user that runs the service as it is, and that user
when it's added to Domain Admins (I will test if the problem occurs if the
user is added to the Administrators group for the domain, which I believe is
the one with all the privileges).

I'd ideally like something that would list all the privileges a user has,
pref using the descriptive name not the symbolic name for the privilege, and
which group they were got through etc.

Or any other suggestions for tracking down this issue!

Thanks,
Dave


.

Relevant Pages

  • Re: Listing user privileges
    ... looks at the live token and lists out the privileges. ... Notice I got rid to the Domain Admins part, ... is not installed on a DC (administrators group of the machine). ...
    (microsoft.public.windows.server.security)
  • Re: Mission Impossible
    ... Force him to use his privileges under a user that is given domain admins ... NOT to log on/operate as the domain "Administrator". ... you already know this person will have privileges to muck about ... > There is a lot of suspicion that this person is messing about with things ...
    (microsoft.public.windows.server.security)
  • Re: Mission Impossible
    ... > Force him to use his privileges under a user that is given domain admins ... you already know this person will have privileges to muck about ... >> of the boss who we have been forced to make a Domain Admin on the ... >> There is a lot of suspicion that this person is messing about with ...
    (microsoft.public.windows.server.security)
  • Re: Need to Prevent Admins from Logging on to all servers
    ... As others said, you can define polices that locks the domain Admins out of your servers, but... ... Just because they have the power to do that doesn't mean that your company policy allows that someone with high privileges can do whatever they want in the domain, if a person cross the line and is caught, that person should be responsible for his/her actions. ...
    (microsoft.public.windows.server.active_directory)
  • Re: 265,000 new zombie PCs a day!
    ... there are so many holes in OS X that will let an attacker ... Windows never was designed to be a network, ... Apple hasn't fixed the "entire problem" on OS X. ... in privileges. ...
    (comp.sys.mac.advocacy)