AccessChk is a Microsoft command-line utility for checking effective permissions on Windows resources. It reports whether specified users or groups can read or write files, directories, Registry keys, services, processes, and system objects. Administrators can inspect full access control lists, filter results, scan recursively, and review process token details.
| Author: | Microsoft |
| License: | Freeware |
| Price: | FREE |
| Released: | May 11, 2022 |
| File size: | 1.00 MB |
| Downloads: | 755 |
| Keywords: | windows permission checker, Sysinternals software suite, permission, check file permissions, service access checker, view, view registry permissions, system permissions analysis, object access evaluation, security descriptor details, view permission, Microsoft AccessChk, command-line tool, accesschk permissions, file permission, viewer, permission viewer, process token viewer |
| Author URL: | https://www.microsoft.com |
AccessChk is a command-line security utility for Windows administrators and other users who need to inspect effective permissions on system resources. It checks which users and groups can access files, folders, Registry keys, Windows services, running processes, and objects in the Object Manager namespace. Rather than relying only on the entries shown in a security descriptor, it evaluates access for a specified account or reports the access available to accounts named by that descriptor.
The utility accepts a resource path and, optionally, a user or group name. Its output marks read access with R and write access with W, making it possible to identify accounts that can read or modify a resource. The read-only and write-only filters narrow results to objects with the selected access, while a filter for objects with no access helps locate denied or unavailable resources. Recursive scanning checks child objects, which is useful when reviewing permissions across a directory tree or a set of Registry keys.
AccessChk can also display a resource's full access control list, including the specific rights granted to an account. An option can omit inherited entries when reviewing a full ACL, helping distinguish permissions set directly on an object from those passed down from a parent. Additional checks cover account rights, service security, process access and token details, threads, and named objects. Filters can limit object checks by type; verbose output includes further access information, and options can suppress errors or the startup banner for cleaner command output.
These checks support practical security reviews, such as finding broadly writable folders, confirming whether a service or Registry key is exposed to a particular group, or investigating what a process account can access. Administrators can use the results to compare intended permissions with effective access and focus follow-up work on resources that need attention. Because AccessChk runs in a console, it fits command-line workflows and can be invoked from scripts or alongside other administrative tools. Typing accesschk displays its usage syntax, and its command options select the resource category and level of detail to inspect.
AccessChk is freeware from Microsoft and is available for Windows, including Windows 10 and Windows 11. It does not provide a graphical interface: users supply options and paths at the command prompt and review the resulting text. The output reports access checks rather than changing permissions, so it can be used for inspection without treating it as an ACL editing tool. Resource paths are interpreted as file-system paths by default; named pipes use the pipe prefix.