Hi, and thanks for your time,

I am working in a Windows 2000 AD Native mode domain.
The scenario is as follows:

user X assigned full control to the group everyone to some disk
(let`s say f

I want to know who is X.

I have been filtering throuhg eventcomb, the event 560 in the security
log, with the text WRITE_DAC, but I can not see who the users is, nor
can I see the group (I know is everyone, but I do not see it in the
event log).

Any help with this will be greately appreciated,

Thanks!