Solved

Can Active Directory Global Groups be applied to the ACL using CACLS?

Posted on 2007-12-04
3
809 Views
Last Modified: 2010-04-21
I'm running a batch file to launch CACLS to modify permissions.  Is it possible to apply Active Directory Global Groups to the ACL using CACLS?  User accounts are working fine in the script.  

The script appears to simply ignore the global groups.  The global groups do not have any spaces.

I have tried encasing the group name with quotes (").

I've tried using the domain name slash domain\groupname in the command line (with and without the quotes)  

I'm running out of ideas.  Thanks.
0
Comment
Question by:scuba101
3 Comments
 
LVL 19

Accepted Solution

by:
SteveH_UK earned 125 total points
Comment Utility
Can you confirm that the groups in question are "security groups" and not "distribution groups" in Active Directory Users & Computers.  Distribution Groups cannot be used in ACLs, but Security Groups (Universal, Global and Local) can all be used in ACLs.

It is best practice to use domain local groups to assign security and global groups to represent groups of users.  You can then combine global groups into universal groups where they are needed to be collected as a set.

Also, be warned, CACLS and XCACLS are not great with permission inheritance.  You may want to look at Powershell:  http://www.microsoft.com/technet/technetmag/issues/2006/12/PowerShell/
0
 
LVL 1

Expert Comment

by:Voo_pg
Comment Utility
CACLS myfile.txt /E /G "Power Users":F

Yes, only security groups will work. The above command would give Power Users, Full Control of myfile.txt

What syntax have you been using?
0
 

Author Closing Comment

by:scuba101
Comment Utility
The problem I was having had to do with an inaccurate path - once I knew AD Global Groups worked, it narrowed down the search.  THanks.
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Join & Write a Comment

If like me you are one who spends a lot of time working and scripting with cmd.exe, sometimes it is handy to be able to quickly view a calendar for a given month and year. This script will quickly do just that!  Save the code posted below to a .bat …
VALIDATING DATES One method of validating dates is to jam the date into the DATE command and see if it accepts it by examining the system's errorlevel value. A non-zero result indicates failure. A typical example might look something like the fol…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now