The world's most trusted forum on Active Directory Security
Hi. I would like to know where one can download the dsrevoke tool from Microsoft? We are trying to get rid of some permissions in our Active Directory and I read in a Microsoft white-paper that the dsrevoke tool can be used to do so.
You can download dsrevoke from Microsoft's website at - http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=19288
I should mention though that while it is a decent tool to remove permissions, it is not the best tool to find out where all a user/group has permissions, because I think it can only find where all a user/group has explicit permissions.
There are other tools you can use to find out where all users/groups have permissions, and of course to modify permissions, as you may know Microsoft's native tools do the job best.
Women's eyes have pierced more hearts than ever did the bullets of war.
Thank you for the pointer. Sure, if you can share any additional pointers on good tools to analyze Active Directory permissions with, that would be helpful.
By the way, nice footer
The most capable permission analyzer tool I know of for Active Directory is called Gold Finger for AD - www.paramountdefenses.com/goldfinger.
I say its the most capable tool because it offers maximum flexibility in terms of being able to specify what permission combination (e.g. Inherited Allow Reset Password Extended Right) you wish to find in your Active Directory, and it can find permissions granted to a user based on membership in security groups.