Is there a way to generate a printout of the current winnt security layout? ie. what directories and files are available to what groups etc. Is there a particular program that does this, or can winnt do it itself?

There is a resource kit utility called srvcheck. From a command prompt just type srvcheck \\%servername% > c:\whatever.txt and it will tell you all groups and what type of access they have to all shares on the server. This tool is in the 2000 server resource kit. Don't know for sure if it comes with the NT4 kit, but if you get your hands on the 2000 executable, it will run under NT4

Thankyou for your help, I'll look into that program. For those of you interested, there are two other options available to do this, I'm not sure how they compare compared to this program as i haven't tested them properly. The first is CACLS, which is a command line program that is part of Winnt. The second is is called DumpSec. download it from http://www.systemtools.com/somarsoft/.