NTFS Folder Audit 1.0.0

First public release. Free, with no licence key and no trial.

Audit NTFS folder permissions on Windows — scan a local path or UNC share, see who
has access to what, find folders where inheritance has been broken, and export an
interactive HTML report you can hand to a client.

What's in it

• Permissions grid — identity, access type, decoded rights, inheritance state
  and flags for every folder in the tree.
• Broken inheritance filter — one click narrows the tree to folders whose ACLs
  are set explicitly rather than inherited. Either a deliberate security boundary
  or a mistake, and the first thing worth reviewing in any audit.
• Owner and modified date per folder, including unresolvable SIDs left behind
  by deleted accounts.
• Compare two paths side by side — a share against its backup, or two client
  folders that are supposed to match. Highlights every folder whose permissions
  differ, plus anything present on only one side, with a "changes only" filter.
• Interactive HTML report — self-contained, searchable, expandable, no external
  dependencies. Also exports CSV.
• Event log listing folders whose ACLs could not be read, so access-denied
  paths are visible rather than silently reported as empty.
• Command line for scheduled audits: --path, --output, --csv, --depth,
  --exclude-system, --open.

Download

NTFSFolderAudit.exe below. No installer — copy it anywhere and run it. Nothing
is written to Program Files and no .NET runtime needs installing.

SHA256  3BE489FFE45E5A104728001ED691A7F020CF88C69AC3A99A9011233509E757DF
Size    161,922,130 bytes (154.4 MB)

Verify with:

Get-FileHash .\NTFSFolderAudit.exe -Algorithm SHA256

The file is large because the .NET 8 runtime is bundled inside it. That's the
trade for "copy it to any server and it just runs".

Two things to expect

SmartScreen will warn you. This build is not code-signed, so Windows shows
"Windows protected your PC" on first run — click More info → Run anyway, or
right-click the exe → Properties → Unblock. Verify the SHA256 above first if
you'd rather be certain what you're running.

Run it as Administrator. It works without elevation, but any folder whose ACL
your account cannot read comes back as access-denied. Those are listed in the
event log rather than being silently skipped, so you will know what was missed.

Requirements

Windows 10, Windows 11, or Windows Server 2016+. No .NET install required.

Licence and cost

Free to use, including inside a business and in paid client work. No licence key,
no trial timer, no gated features, no scan limits, no account, no watermark.

It contains no network code at all — no telemetry, no analytics, no update check.
The only URLs in the source are three links in the About dialog that open in your
browser when you click them.

Released under PolyForm Shield 1.0.0:
use it however you like, just don't sell it.

If it saves you an afternoon, you're welcome to
buy me a coffee. That's the whole business model.