NTFS rights & Inheritance 1

[segil]

Hello NG,

I have got a question about changing NTFS rights and inheritance...
One of our fileservers hosts all the files for our R&D department. This
shared folder contains of about 10.000 directories and 200.000 files.
NTFS permissions are set on the directories and about 100 different security
groups are used to set the necessary rights on the directories.
Inheritance is used in most cases, but there are also a lot of directories
with inheritance DISabled.

Okay, that is the current situation. Now my manager wants to add one
security group to ALL directories, which will be granted full control.
How do I do this, with the inheritance in mind? When I add this new security
group to the top level of the directories, obviously only the directories
with inheritance enabled will "receive" this new ACL. But the directories
with inheritance disabled, also need to be changed.
When I use (x)cacls, inheritance is just disabled on all directories (seems
cacls is not aware of the inheritance option?), so that won't work either...

Does anybody know how to solve this, without the need to change all folders
manually? Is there an advanced tool (from a third party) that can change
ACLs in this way, maybe using a nice GUI to configure the appropiate rights?

Thanks in advance.

 

[markdmac]

Actually you can do this with XCACLS.VBS which is a free download from Microsoft.

The help file is rather cryptic in my opinion so take your time studying it.

You will want to use the /E switch which will preserve the existing rights while allowing you to add this new right.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[segil]

Woh, thanks! That sounds great, I will take a look at it asap.

Also I found another product that maybe would do the trick:

http://setacl.sourceforge.net/

Familiair with that one?

 

[markdmac]

never used it.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[segil]

Hello Mark,

you have looked at the manual of xcacls.vbs.. seems a lot like the normal program xcacls.exe.

Are you sure it is possible to ignore the inheritance settings, without changing it?

 

[markdmac]

I have already given you the switch you need. /E tells it to edit the existing permissions. Use that with /G to grant a new group permissions.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript