asked on

Setting up a GPO to give a Local Group Access to local file system

I need to grant certain developers & support personnel read/write access to the local file system (C:\ and D:\). I need to do this on about 10 servers and I would like to setup a local group named 'ProductionSupport' that will be granted read/write acess to the local disks via GPO. This way if I need to do this on many servers in the future all I would need to do is create a local 'ProductionSupport' group and populate it with the appropriate domain users. How do I accomplish this?

Kevin Hays

Well from the sounds of it they need to be probably power users of the local machine or is that too much power for those developers for you? If you just want them to be users only and have write/read access then you can use xcacls or cacls. Xcacls is more poweful than cacls and you will have to download it, it's free if i'm not mistaking.

An example of adding a domain security group to the local machine is this.

net localgroup "power users" domain\security_group /add

You can just add that command in a batch script and then link the gpo to the OU that those 10 servers are in. That command will add the security group you chose to replace "domain\security_group" to the power users of that local machine.

That would be the easiest if you didn't care if they were power users on the machine and if you could create a GPO and link it to the OU's that the servers are in.

If not then use xcacls or cacls. It's not really hard to use those programs to give specific groups access rights to files, folders, etc....

regards,

kshays

bangia_v

ASKER

One question. Do Power Users have the ability to stop/start services?

ASKER CERTIFIED SOLUTION

Kevin Hays

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial