Has anyone ever run the dsrevoke utility to see what AD permissions have been set? Am I correct in thinking to check everyone in your domain - youd have to run dsrevoke for each user/group - so 500 users or 300 groups means either 500 dsrevokes or 300 dsrevokes? as opposed to running a master report for all users and showing all delegations/ad permissions?

What you want to solve? Any special problem? The strenght of dsrevoke is in different space that reconfiguring all objects in AD: http://www.windowsitpro.com/article/domains2/dsrevoke Here are basic information and best practices http://66.14.166.45/whitepapers/os/windows/ad/Dsrevoke%20Tool.pdf Regards Milos

What you want to solve? Any special problem? The strenght of dsrevoke is in different space that reconfiguring all objects in AD: http://www.windowsitpro.com/article/domains2/dsrevoke Here are basic information and best practices http://66.14.166.45/whitepapers/os/windows/ad/Dsrevoke%20Tool.pdf Regards Milos