Outcome

Completed a read-only permission audit across reachable SMB servers: server01, server02, server03, server04, server05, server06, and server-host. No permissions, ownership, shares, files, or folders were changed.

Scope

• Shares discovered: 62.
• File-path shares audited: 51.
• ACL rows captured: 1,650.
• Scope was share roots plus one child level where reachable.

Highest-Priority Root Findings

• SERVER05 D:\Operations via share Operations: owned by CORP\zazzit; zazzit ACE present; inheritance protected; no explicit Sam/Admin/Domain Admin NTFS ACE found at root. Share layer includes Administrators and Everyone.
• SERVER05 D:\Employee Hub via share Employee Hub: owned by CORP\zazzit; zazzit ACE present; inheritance protected; no explicit Sam/Admin/Domain Admin NTFS ACE found at root. Share layer includes Administrators and Everyone.
• SERVER01 F:\Closed Cases via share Closed Cases: owned by CORP\zazzit; zazzit ACE present; inheritance protected; no explicit Sam NTFS ACE found. Share layer includes Administrators and Everyone.
• SERVER-HOST G:\elc (Backup 12.28.25) via share elc (Backup 12.28.25): owned by CORP\zazzit; zazzit ACE present; no explicit Sam NTFS ACE found. Share layer includes Administrators, kmedlin, and nhatfield.

Other Findings

• SERVER-HOST G:\Archive- Too Large for GDrive is still published as a share but the advertised local path was not found during ACL readback, likely stale/broken share path or renamed folder.
• SERVER-HOST G:\Google Drive has zazzit ACEs and protected inheritance, but should stay approval-required because it is active Google Drive workspace.
• SERVER03 C:\NEEDLESBACKUP has zazzit/old SID ACEs and no explicit Sam ACE, but Administrators rights are present at root.
• SERVER01 D:\Dropbox and SERVER01 F:\Media Server still have zazzit ACEs but Sam already has FullControl.

Artifact Folder

C:\Users\SAguiar\Documents\Codex\permission_audits\multi_server_permission_audit_20260429_221254

Key files: