Using WHOAMI.exe to troubleshoot NTFS Permissions in Windows

Home > Videos > Windows 10 > Using WHOAMI.exe to troubleshoot NTFS Permissions in Windows

Using WHOAMI.exe to troubleshoot NTFS Permissions in Windows

Like This Video 0 166 Rick Trader
Added by July 9, 2015

See our class schedule for complete Windows 7 and Server 2012 Training.
Classes are held in Phoenix, AZ and can be attended online from anywhere in the world with RemoteLive™.

Instructor: Rick Trader

Video Transcript:

One of the most common problems you will run into as an IT administrator when working in an enterprise or a domain environment is when a user attempts to access a resource and receives a message stating “Access Denied”.  Or visa-versa, a user is able to access a resource that they shouldn’t have access to.

WHOAMI.exe is one of the tools that I like to use to help me troubleshoot user NTFS permissions. This is a tool that a lot of us administrators have over-looked for years.

Here’s how to use WHOAMI.exe and some of its switches.

Starting at my command prompt and logged on as the user.


As a Help Desk person, I can have the user on the phone and bring up their command prompt or I could remote desktop with them with any of the corporate tools that you may already have that allows you to connect to them or you can have the user do this over the phone by having them launch a command prompt and have them type [whoami].


Most of us administrators in the IT industry already know about this command, we’ve used it frequently to determine whether the user is logged on with the appropriate credentials. You can find out if they’re logged into the domain and to see if they’re logged into the machine.


A switch that many people don’t know is “whoami forward slash all”       whoami /all


This switch will show me not only who I’m logged in as but it will also show me my current user SID and it also shows me the Groups that I am currently a member of.


In other words, it’s showing me my current access token. In Windows NT 4.0 and Windows 2000, you may have heard of a utility called “MYTOKEN.exe”. You could download it and accomplish the same thing.

In Windows 7, it shows me that I’m a member of groups. For example, Everyone, Users, Console Logon, Authenticated Users etc…  These are all the built-in groups and local groups.


But notice; it also shows me that I’m logged on as “rickt” and that I’m a member of a group called [_D Sales SP A Change] , [_G Sales Users]  [_G Sales Manager] etc…


WHOAMI is displaying all the groups I’m currently a member of in standard naming conventions. I.e. “_D” is a Domain Local Group while “_G” is a Global group. Therefore, I know that the “_G Sales Special Project A” is in the “SP A Change” folder.

WHOAMI /all also shows me the privileges I currently have on this machine.


You’ll notice the “Change the time zone” requires elevated permission levels to do this and it’s displaying the state of “Disabled”. Others are also Disabled such as “Shut down the system”.  Therefore, when you try to shut down, it’s going to ask you for elevated privileges.

The big concept is that it’s showing me the groups.


Many students have asked me “How long has whoami / all been around?”  It’s been available in Windows XP, Windows 2003, Windows 2008 & 2008 R2, Windows 7, Server 2012 and now in Windows 8. They all have the whoami.exe command. It’s an awesome command available for troubleshooting.

There are a couple additional switches in “whoami.exe”.

If we use the question mark:      whoami /?



I can show my logon information and parameters such as:


/UPN – User Principle Name

/FQDN – Fully Qualified Distinguished Name

I can show just my USER SID or Just my Group SID

/PRIV – Privileges

/LOGONID – Is an option if my logon id is different than my user ID.

We can also format with the /FO option and format it as a table, list or a CSV.



If I format it as a CSV

Using “FO” Format Out

whoami /all /fo csv


Notice that it did format this as a coma separated values CSV file. Notice the comas between each field?

If you wanted to output this to a file you would need toe pipe it “|” out or perform the typical “out” such as [C:\myacccestoken.txt]


This outputted to a text file. If I go into Windows Explorer and look into the user folder:

Select my folder which is names “rickt”:


The file is located:


And here is the coma separated values CSV file:


Having it in a text file allows the user to troubleshoot much easier.

One of the changes that is made to this if you’re looking at whoami from Windows Server 2012 or a Windows 8 computer is underneath privilege name you will see an area called “Claims”. If you’re doing Claimed-Based Authentication this will show you your claims.

I hope this has helped you with troubleshooting NTFS Permissions and determining what a Groups a particular user is a member of.

Until next time, ride safe.
Rick Trader
Windows Server Instructor – Interface Technical Training
Phoenix, AZ

Videos You May Like

Windows 10 Managing, Deploying and Configuring – December 2, 2015

0 443 1

In this recorded Windows 10 training webinar from December 2, 2015, Windows Server instructor Rick Trader presents the deployment and management of Windows 10 Enterprise and the new Provisioning capability in Windows 10. Learn how to manage Windows 10 deployments using System Center Configuration Manager, Mobile Device Management and Intune. Also included in his presentation … Continue reading Windows 10 Managing, Deploying and Configuring – December 2, 2015

How to clone a Windows Server 2012 or 2012 R2 Domain Controller

3 1566 3

One of the coolest new features in Window Server 2012 and Windows Server 2012 R2 is the ability to clone a Domain Controller. In the past, if we had virtualized Domain Controllers and we actually took a snapshot of it and then rolled back to that snapshot, it would break the logon service on that … Continue reading How to clone a Windows Server 2012 or 2012 R2 Domain Controller

Detailed Forensic Investigation of Malware Infections – April 21, 2015

4 645 5

How does an investigator hunt down and identify unknown malware? In this recording of our IT Security training webinar on April 21, 2015, Security expert Mike Danseglio (CISSP / CEH) performed several malware investigations on infected computers and identify symptoms, find root cause, and follow the leads to determine what’s happening. He demonstrated his preferred … Continue reading Detailed Forensic Investigation of Malware Infections – April 21, 2015

Write a Comment

Share your thoughts...

Please fill out the comment form below to post a reply.