Script to change permissions to home folders

I executed it, I believe, correctly as it seemed to be working, however, I checked the permissions and the user still had full rights instead of change.  Here is how I executed it:

SetPerm "E:\MS\GMS\Users" "STUDENTS" C

Is this correct?

Is STUDENTS the name of your domain?  Try removing the quotes around the domain name.

That is the netbios name of the domain.  I removed the quotes, it paused, I checked and the student still had full rights.

What OS is the server?

Windows Server 2003 R2 64-bit

Try this version.

@echo off
setlocal
IF {%1}=={} GOTO bad
IF {%2}=={} GOTO bad
IF NOT EXIST %1 GOTO bad
IF {%3}=={} set perm=C&goto ok
if {%3}=={C} set perm=C&goto ok
if {%3}=={F} set perm=F&goto ok
goto bad
:ok
set pf=%1
set dom=%2
set pf=%pf:"=%
set dom=%dom:"=%
for /f "Tokens=*" %%a in ('dir "%pf%" /AD /B') do set user=%%a&call :parse
endlocal
GOTO :EOF
:bad
@echo Usage: SetPerm "Drive:\Directory of Users Parent Folder" "NetBIOS Domain Name" [C or F]
@echo.
endlocal
goto :EOF
:parse
for /f "Tokens=5*" %%c in ('echo Y^| cacls "%pf%\%user%" /T /G Administrators:F "%dom%\%user%":%perm% "%dom%\Domain Admins":F') do @echo %%d
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:

Dude! Almost perfect.  Can the script not remove inherited rights?

What I normally do is reset the permissions to administrators full on the top folder and under advanced check replace permissions on all child objects and uncheck inherit from parent.  This fixes everything so only administrators have access to all user folders, then I run the script to add the users permissions.

Really, I just wanted to change the students permission from full to change without removing the inherited rights from the parent folder.  Is there a way for that?

Sorry I miss read your question.   This should edit the permissions rather than replace them:

@echo off
setlocal
IF {%1}=={} GOTO bad
IF {%2}=={} GOTO bad
IF NOT EXIST %1 GOTO bad
IF {%3}=={} set perm=C&goto ok
if {%3}=={C} set perm=C&goto ok
if {%3}=={F} set perm=F&goto ok
goto bad
:ok
set pf=%1
set dom=%2
set pf=%pf:"=%
set dom=%dom:"=%
for /f "Tokens=*" %%a in ('dir "%pf%" /AD /B') do set user=%%a&call :parse
endlocal
GOTO :EOF
:bad
@echo Usage: SetPerm "Drive:\Directory of Users Parent Folder" "NetBIOS Domain Name" [C or F]
@echo.
endlocal
goto :EOF
:parse
for /f "Tokens=5*" %%c in ('echo Y^| cacls "%pf%\%user%" /T /E /G Administrators:F "%dom%\%user%":%perm% "%dom%\Domain Admins":F') do @echo %%d 
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:

Doesn't run.  The prompt will come back after about 30 seconds and the acls are not changed.  Any ideas?

try removing the /T in the last line so it is just /E /G

Sorry.  Same symptoms

Try these switches /T /E /C /G

Sorry.  Same symptoms.  I know you are so close. Please hang in there!

Please try it again the way it was working with /T /G to make sure something else is not wrong.

That works fine but, as expected, it replaces the acl and turns off inheritence.

When you are done testing are you turning inheritence back on for the folders?  

Just to clarify, if your top folder is E:\MS\GMS\Users after you run the script inheritence is off for the user folders, correct?  So for User1, properties show inheritence off, but if you go to a sub folder of User1 it is back on, correct?

And you want to have inheritence turned on from the Top USERS folder?  What are the permissions of the top USERS folder?

All the permissions are correct, except changing the user from Full to Modify?

I have an idea I am testing to make this work for you, but I want to verify everything 1st

First of all, I really appreciate the work on your part.  

Basically, we have computer teachers and the parent directory who manage the students in their building.  That's why I need to have the students home directory to continue to have inheritance (in case we have to change teachers) from the top users folder.  So, if my home folder is e:\ms\gms\users\jstudent, I should only have change rights and have the permissions flow from e:\ms\gms\users directory through my folders.  That being said, all the permissions are fine as they are, we only need to change the students permissions in their home folder from full to change and leave everything else the same.

Hope this helps.

You are most awesome, Sir.  Thank you for hanging in there for me.  This is going to save our techs hours and hours seeing that we have about 15,000 students.

Have a great weekend!

Very awesome.  Best solution yet!  Worth the price of membership.