tfield98
asked on
How to use calcs or icacls to set inheritance
I have an app that installs on XP and Vista. The installer of course runs as Admin.
I want to force a folder C:\programdata\OurApp and all subfolders so that the users group has all permissions (although they don't need to change permissions, just more-or-less full end-user functions: list folder, delete, create, read, write files and folders). I understand that the command that would do this has to be run with admin privileges.
I seem to be having a problem with inheritance (which I don't really understand anyway, in spite of considerable reading online). If I set the permissions for users to full, but then create a file as an admin, users don't have full rights on the file, but I want them to. I don't want some admin running our app once and by doing so creating files that admin owns and users don't have full access to.
I've tried a variety of command lines without success to force the users group to have all rights on all files and folders (current and newly created) in a tree:
icalcs c:\programdata\OurApp /T /C /Grant Users:(OI,CI,MA)
calcs c:\programdata\OurApp /T /C /E /G Users:F
Can I use calcs in Vista, or (since it's deprecated) should I use icalcs there for this operation?
Can I use icalcs in XP?
Would using xcacls (which I just learned of here at ee) be appropriate on Vista and XP, or is it too deprecated? If it's the appropriate solution, what's the command line?
Can these commands be run on the directory tree on a Microsoft server that the app is installed on, or just a local drive?
Any help would be greatly appreciated.
Tom
I want to force a folder C:\programdata\OurApp and all subfolders so that the users group has all permissions (although they don't need to change permissions, just more-or-less full end-user functions: list folder, delete, create, read, write files and folders). I understand that the command that would do this has to be run with admin privileges.
I seem to be having a problem with inheritance (which I don't really understand anyway, in spite of considerable reading online). If I set the permissions for users to full, but then create a file as an admin, users don't have full rights on the file, but I want them to. I don't want some admin running our app once and by doing so creating files that admin owns and users don't have full access to.
I've tried a variety of command lines without success to force the users group to have all rights on all files and folders (current and newly created) in a tree:
icalcs c:\programdata\OurApp /T /C /Grant Users:(OI,CI,MA)
calcs c:\programdata\OurApp /T /C /E /G Users:F
Can I use calcs in Vista, or (since it's deprecated) should I use icalcs there for this operation?
Can I use icalcs in XP?
Would using xcacls (which I just learned of here at ee) be appropriate on Vista and XP, or is it too deprecated? If it's the appropriate solution, what's the command line?
Can these commands be run on the directory tree on a Microsoft server that the app is installed on, or just a local drive?
Any help would be greatly appreciated.
Tom
cscript xcacls.vbs c:\programdata\OurApp /E /P /F /T /P domain\user:f /Q
This will add to existing permissions, in OurApp and all subfolders and files, for domain\user to Full Control, and will not report to screen.
iCacls is designed for Vista/2008 Server, and might be the better bet : http://technet2.microsoft.com/windowsserver2008/en/library/403edfcc-328a-479d-b641-80c290ccf73e1033.mspx
This will add to existing permissions, in OurApp and all subfolders and files, for domain\user to Full Control, and will not report to screen.
iCacls is designed for Vista/2008 Server, and might be the better bet : http://technet2.microsoft.com/windowsserver2008/en/library/403edfcc-328a-479d-b641-80c290ccf73e1033.mspx
ASKER
Hi, guys,
Thanks for the suggestion to use xcalcs.vbs. I didn't realize it was a script. I'm reluctant to use it because of that. And because it's quite old, I'm worried that it may not be right for Vista.
and235100 - Yes, I've seen the icalcs page at Microsoft. Thanks for suggesting it, though. I've been trying to make it work using their documentation for the past few days. It's the route I want to take... if I can figure out how to make it work. The examples in my original post aren't working for me.
So, I'm hoping some ACL, icacls.exe guru will jump in here and tell me how to make it do what I want on Vista.
Thanks again, guys.
Thanks for the suggestion to use xcalcs.vbs. I didn't realize it was a script. I'm reluctant to use it because of that. And because it's quite old, I'm worried that it may not be right for Vista.
and235100 - Yes, I've seen the icalcs page at Microsoft. Thanks for suggesting it, though. I've been trying to make it work using their documentation for the past few days. It's the route I want to take... if I can figure out how to make it work. The examples in my original post aren't working for me.
So, I'm hoping some ACL, icacls.exe guru will jump in here and tell me how to make it do what I want on Vista.
Thanks again, guys.
ASKER
Here's the syntax that I *think* should work, but isn't:
iacls "C:\ProgramData\MyApp*.*" /T /C (OI) (CI) /Grant Users:F
I'm having trouble with the OI and CI parameters... in fact, I'm not even sure that I need both (either?) of them.
iacls "C:\ProgramData\MyApp*.*" /T /C (OI) (CI) /Grant Users:F
I'm having trouble with the OI and CI parameters... in fact, I'm not even sure that I need both (either?) of them.
ASKER
My previous post had a typo in the program name. It should read:
icacls "C:\ProgramData\MyApp*.*" /T /C (OI) (CI) /Grant Users:F
Furthermore: TechNet states: "nheritance rights may precede either Perm form" But I can't figure out *how* they precede it.
icacls "C:\ProgramData\MyApp*.*" /T /C (OI) (CI) /Grant Users:F
Furthermore: TechNet states: "nheritance rights may precede either Perm form" But I can't figure out *how* they precede it.
According to http://support.microsoft.com/kb/943043
it seems that Icacls has some issues on Server 2003 SP2...
I know that this doesn't directly affect you on Vista - but did you try xcacls.vbs ?
Anyway, perhaps -
[/setintegritylevel [(CI)(OI)]<Level>:<Policy> [...]]
icacls "C:\ProgramData\MyApp*.*" /T /C /setintegritylevel (OI) (CI) /Grant Users:F
I cannot try this out atm, my Vista stations are off!
I haven't had much experience with icacls - it doesn't seem as friendly as xcacls...
it seems that Icacls has some issues on Server 2003 SP2...
I know that this doesn't directly affect you on Vista - but did you try xcacls.vbs ?
Anyway, perhaps -
[/setintegritylevel [(CI)(OI)]<Level>:<Policy>
icacls "C:\ProgramData\MyApp*.*" /T /C /setintegritylevel (OI) (CI) /Grant Users:F
I cannot try this out atm, my Vista stations are off!
I haven't had much experience with icacls - it doesn't seem as friendly as xcacls...
ASKER
Thanks, and. I did not try xcacls.vbs. Using a script (especially one that predates Vista) isn't a solution I want to use. Thanks though.
You a minor typo: missing \ before the *.* However, your icacls suggestion gave me the errror (The parameter (IO) is incorrect. Darn...
I said I hadn't used icacls much...
;-)
Have you cd'd to the C:\Windows\system32 directory first, before running icacls?
Probably unlikely that you would overlook that...
It seems these options have been available for a while:
http://support.microsoft.com/kb/220167
;-)
Have you cd'd to the C:\Windows\system32 directory first, before running icacls?
Probably unlikely that you would overlook that...
It seems these options have been available for a while:
http://support.microsoft.com/kb/220167
ASKER
I'm not having trouble getting the exe to run (system32 is in my path).
I'm having trouble with the synatax of these Container Access Inheritance Flags in the icacls.exe command line.
Thanks for the link to the page with the discussion of them. I believe I know which flags I want, I can't seem to figure out the syntax in the icacls command line!
Thanks again!!
I'm having trouble with the synatax of these Container Access Inheritance Flags in the icacls.exe command line.
Thanks for the link to the page with the discussion of them. I believe I know which flags I want, I can't seem to figure out the syntax in the icacls command line!
Thanks again!!
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Would the question still be available when the topic is searched upon? There is some very good information here.
ASKER
I don't know if it remains visible. I hope so. That's why I posted the answer I found. Maybe a moderator/administrator will let us know.
Closed, 500 points refunded.
Vee_Mod
Community Support Moderator
Vee_Mod
Community Support Moderator
Microsoft has the vbs on the web site and you ca set inheritance with the vbs.
http://support.microsoft.com/kb/825751