lsacl

List MVFS ACLs.

lsacl [ –s | –l ] [ –n ] { [ –f path-name ] | [ –r registry-value-name ] }

Options

–s | –l Specifies short or long format; displays generic rights, by default.

–n Specifies that the numeric security ID (SID) is not to be translated into the user’s name. Use this option if the domain controller is down or if the user’s account has been removed.

–f Reads a security descriptor from a file; allows you to display the contents of the filesidentity.sd and groups.sd.

–f Reads a security descriptor from a file; allows you to display the contents of the files identity.sd and groups.sd.

–r (Windows® only) Reads a security descriptor from a Windows registry value. Specify registry-value-name i in the form RootKey\ValueName where:
RootKey is one of HKLM, HKCU, HKCR, HKU, HKCC. HKLM is assumed if RootKey is omitted.

ValueName is the full pathname of a subkey of the specified RootKey

Note: You can also use the Windows cacls utility to display an NTFS ACL, but cacls cannot read a security descriptor from a *.sd file.