I have a user that is getting a read only session when they log into the client (across the top of the Laserfiche client window states read only).  This is in a very large domain with a huge number of AD groups and AD groups as members of other AD groups.  Is there a tool available to trace where the Retrieval Only attribute is being picked up from?