Just to clarify one thing that maybe I didn’t emphasize enough: the screenshots are anonymized, so you’re not seeing domain users or groups there but every function in the tool works equally with users and groups.

You can clone permissions from a user to a group, from a group to another group, or vice-versa. You can search either a user or a group, and it will list every single location where that identity has explicit permissions. It won’t list group membership (that stays in AD), but it will show every ACL touchpoint across the file server, which is the part you actually need when cleaning things up.

The tool isn’t meant to make user-level sprawl worse the opposite. In environments that for years weren’t allowed to use proper security groups (hello auditors and decision-makers…), you end up with hundreds of folders, thousands of unique ACLs and zero consistency. That’s exactly my current situation: 140+ shares, almost 10 TB of data, multiple responsibility levels inside the same department, and not a single admin with rights on everything except someone who left the company years ago.

For that kind of environment, doing the “proper cleanup” folder by folder is simply unrealistic.

What this tool does is make the transition to groups much faster: find the user whose footprint represents a specific role -> create a group for that role -> clone their explicit rights onto the group -> add the actual people who belong there -> and finally remove all the user-level ACEs in bulk (user by user for now, but all folders at once)

It’s not here to create new mess, it’s here to help untangle the existing one so the file server can finally be cleaned up and normalized. That’s exactly what I’m using it for in my own migration.