A script to modify NTFS permissions? 2

[Rinnt]

Hello everyone,

I am in need of a script that will modify NFTS permissions. Here is the senario... I have a number of user directories that need their permissions changed to allow their user name (matches their directory) to have CHANGE and domain admins to have FULL CONTROL. But no other permissions should be applied...

Is this possible?

Another nice script would be one that changes the department folders so you could say something like:

C:\dept\finance Finance = Change Domain Admins = Full
C:\dept\mkting Marketing = Change Domain Admins = Full

and so on...

Thank you in advance!

 

[wolluf]

use the CACLS command?

 

[Rinnt]

I thought CALCS only applied to IIS?

 

[hjm3857]

There is a realy cool GUI for cacls commands that can be found at

http://teachers.sivan.co.il/yizhar/

. This guy has created some cools freeware, there is also a neat tool for building basic PIX (wrong forum I know) configs for pre-installation time savings.

Jay Mosser
jaym@optymgroup.com

 

[Rinnt]

While NUTS is useful, it appears that cacls might be the easiest way to accomplish the desired effect. Now I need to figure out how to automate it. It doesn't appear that cacls can change a large amount of perms at a time. Rather it seems to be designed for single user management.

Would there be a way to use cacls that would change a large number of perms? Perhaps utilizing a batch file? Ideally it would go down the folders of a certain drive letter (mapped) and assign the perms to the user/folder name. If nothing else, maybe there is a way to input variables into a batch file? Something to the effect of

PermFix.bat %jrsmith

or

PermFix.bat %adrogers
PermFix.bat %avbellow
PermFix.bat %lpsallas

so it would know to plug jrsmith as the username and folder that it's applying the perms to... Any ideas guys?

 

[Rinnt]

Not surprisingly, I have answered my own qutestion.

If any of you are in a simular situation that I am in, here's how I figured it out.

After reading on

http://www.robvanderwoude.com/index.html

I compiled the following batch file to set the users to have CHANGE and domain admins to have FULL permissions. Note that xcacls.exe must be in the directory of execution and can be downloaded from microsoft's website. The FOR line is one contigous line:

CD /D J:\home\users
FOR /D %%A IN (*) DO XCACLS "J:\home\users\%%A" /T /G "Domain Admins":F "%%A":C /c /y

Anyone find this to be useful? Also, does anyone have any idea how to trap errors? For example if the script tries to write perms to a directory with no user name it would log it to a file...

 

[jtb]

is a script the way to go? might it be more elegant with system policy editor? JTB
Solutions Architect
MCSE-NT4, MCP+I, MCP-W2K, CCNA, CCDA,
CTE, MCIWD, i-Net+, Network+
(MCSA, MCSE-W2K, MCIWA, SCSA, SCNA in progress)

 

[Rinnt]

How would you accomplish this task using a policy? What are the advantages in using this method?

 

[jtb]

How is too long for this forum; but you can create computer, user, and group policies limiting or authorizing anything.

The disadvantage is the initial learning curve. The advantages include being able to controll any feature you want to control... JTB
Solutions Architect
MCSE-NT4, MCP+I, MCP-W2K, CCNA, CCDA,
CTE, MCIWD, i-Net+, Network+
(MCSA, MCSE-W2K, MCIWA, SCSA, SCNA in progress)

 

[wolluf]

jtb,

but u can't change file/folder permissions with policies - so they're not much use in this case!