Zutritt – Share and NTFS permissions report

Who can access what – and through which group?

On file servers that have grown over the years, it is often hard to see who can go where: rights hang on nested groups, inheritance is broken somewhere, moved folders carried their old rights along. A periodic user access review for file shares still needs a clear answer and evidence.

Zutritt answers exactly that question – who can access what, and why – with a folder access report for admins and auditors who need the answer regularly without introducing a new platform.

What the permissions report covers

• Read share and NTFS permissions

  A share, a whole server, local folders or all shares of this PC. Junctions are recorded but not followed.

• Effective permissions, computed like Windows

  Stored ACE order (non-canonical lists included), deny entries, inheritance, OWNER RIGHTS and share combined with NTFS – checked against the Windows access check in the test suite.

• Groups down to people

  Local accounts and groups of the scanned server and, on domain-joined PCs, Active Directory – nested, with cycle protection.

• Who can get in here? Where can this person go?

  Per folder, every person with the effective right and the group chain; per person, every folder they can reach – including nested groups and disabled accounts.

• 15 rules with a recommendation

  Broad group can write, orphaned SID, right given to an individual, full control for non-admins, hidden inheritance breaks, moved folders, entries in the wrong order – each with an explanation and a recommendation.

• Comparison with the last run

  New and resolved findings, changed ACL entries and group memberships – and who can now access more or less.

• Excel to work with, PDF to sign

  Filterable Excel workbook with every entry; PDF with cover, summary, findings and a sign-off block for reviewer, date, signature and remarks.

• Command line and scheduled tasks

  Zutritt.exe scan with comparison and report, exit codes 0–3 for monitoring – e.g. every Monday morning as a scheduled task. Commands and options have English and German spellings.

The 15 rules for auditing folder permissions

ACL findings are reported where an entry is set explicitly – not again on every folder that inherits it.

For access reviews and audits

Periodic reviews of access rights are expected in GMP environments (EU GMP Annex 11), under ISO/IEC 27001 (control A.5.18 “Access rights”) and NIS2. For a file share permissions audit, Zutritt produces the evidence: what was checked, by whom, when, with which result and what changed since last time – and a page to sign.

Zutritt is not a validated system and makes no compliance claim. It is a read-only analysis tool; how it is qualified and used in a regulated process is up to the operator.

Switching from commercial permission reporting tools: Zutritt as an alternative

If you report on file share permissions with a commercial permission reporting tool today, Zutritt does the same job: showing who can access which folder. What Zutritt offers:

• share and NTFS permissions together, effective permissions computed like Windows – tested against the Windows access check
• groups down to individual people: local accounts and groups of the server and Active Directory of the own domain, nested
• 15 rules with an explanation and a recommendation, and a comparison with the last run
• Excel workbook with filters and a PDF with a sign-off block
• read-only, no server, agent or service; command line with exit codes for scheduled tasks
• free of charge under the MIT licence, no licence key, no licence server, no telemetry

Worth knowing before you switch: Zutritt runs only on Windows 10 version 1809 or later and Windows 11 (x64), resolves Active Directory only for the scanning PC’s own domain and has so far been tested against a simulated directory only. It does not monitor continuously and does not change permissions.

System requirements

Operating system

Windows 10 version 1809 or later, or Windows 11, x64 – Windows only, because NTFS, shares and Active Directory can only be read there

.NET

not needed for the MSI and Zutritt.exe; the ZIP needs the .NET 10 Desktop Runtime

Rights

an account that can read the permissions you want to see; share permissions need administrator rights on the server

Active Directory

optional, when the scanning PC is a member of the domain

Language

user interface, command-line output and reports in English, German, Spanish, French and Chinese (the last three machine-translated, not yet reviewed by native speakers)

Limits, honestly

• Pre-release, not code-signed yet: SmartScreen may warn; the downloads can be checked with SHA256SUMS.txt.
• Active Directory only for the scanning PC’s own domain; groups from trusted domains are named but not expanded. Tested against a simulated directory so far, not yet in a real domain.
• When in doubt, Zutritt shows more access, not less: conditional allow entries count, conditional deny entries do not, unreadable share permissions mean “NTFS only”.
• Files are only examined with --dateien, and then only files with their own permissions.
• Very large reports are truncated with a visible notice – the PDF earlier than the Excel workbook.
• No continuous monitoring and no file-access auditing; Zutritt deliberately does not change permissions.