<div>
Correction: attrib line must have enclosing quotes like in xcacls, if spaces are used in file names.<br />
&nbsp; &nbsp;<br />
<br />

<pre><code class="code-1 nolinks" id="code-122889"><span>@echo off</span>
<span>for /F &quot;delims=*&quot; %%F in ('xcopy /A /S /L h:\casework\*.jpg \ ^| findstr /v copied') do (</span>
<span>  xcacls &quot;%%F&quot; /T /P &quot;Authenticated Users:R&quot; /Y</span>
<span>  attrib -a &quot;%%F&quot;</span>
<span>)</span>
</code></pre>
</div>


<div>
Hey Qlemo, thanks for your response. &nbsp;Since you mentioned backup software, I should expand on what I am doing a bit. &nbsp;My backup method for these files is as follows. &nbsp;I am not backing up the photos with any backup software. &nbsp;I am replicating these photos via DFS-R to a second storage server. &nbsp;Since it is a 1 to 1 backup I cannot have any chance of anyone deleting photos, which is the reason why I need to set these permissions. &nbsp;The problem I am running into is that if I change the permissions nightly on all the files then it wants to replicate all the files all over again, and replicating 2tb of files nightly takes to long.<br />
<br />
Now that you know this, does this change either of your suggestions? &nbsp;If not, can you explain to me what your script is doing. &nbsp;How do I use Archive Bit? &nbsp;Is that a portion of your script?<br />
<br />
Thanks again for the quick response!
</div>


<div>
That does not change anything. My script resets the archive bit file after file AFTER changing ACL, so even if you break the script somewhere in-midst you can start it over again.<br />
<br />
Since only new or changed files are touched, there should be no problem with your replication.<br />
<br />

</div>


<div>
Cool. &nbsp;<br />
<br />

<ul>
<li>I just tried the script on some test files to make sure it is applying the permissions correctly. What your script seems to do is wipe all permissions on .jpg files and leave Authenticated users with read only. I would like to leave the original permissions in tact for other groups.</li>
</ul>
<ul>
<li>Also, I am still able to delete .jpg files as a normal authenticated user after applying your script. &nbsp;I look at the permissions when logged on as a user and it shows the correct permissions and I shouldn't be able to delete the file... but I still can. &nbsp;Weird. </li>
</ul>
Thanks for your help!<br />

</div>


<div>
Oh, I see, I swapped /E and /T options. The line must be<br />
<br />
&nbsp; &nbsp; xcacls &quot;%%F&quot; /E /P &quot;Authenticated Users:R&quot; /Y<br />
<br />
That's the reason the permissions were replaced completely instead of partional only. Please try again.<br />
<br />

</div>


<div>
Alright, great! &nbsp;I've tried this again and were halfway there. &nbsp;It keeps the previous security groups in tact but a user is still able to delete the .jpg files. &nbsp; According to the permissions they should not be able to, but they still are. &nbsp;Any ideas?<br />

</div>


<div>
I figured that out! &nbsp;On a top level folder the Authenticated user group had &quot;special permissions&quot;. &nbsp;I changed this to &quot;modify&quot; permissions and the script runs great!!! &nbsp;<br />
<br />
I do have one more question... I'm thinking it through at the moment. &nbsp;I will post back within the hour. &nbsp;<br />
<br />
I'm excited for this to work!!!! &nbsp;Woot!! Woot!!<br />

</div>


<div>
Ok, so here is what I am wondering:<br />
<br />
1. Shouldn't the /T swtich be left so that it will apply the settings to all subfolders?<br />
<br />
2. Say I wan't to take out the /E switch and have it rewrite the permissions on .jpgs rather then modify them. &nbsp;How would I add the administrators account with full permissions to this script?<br />
<br />
I'm leaving work for the day shortly, so I will be anxious to hear back from you tomorrow. &nbsp;Thanks for all your help, you have no idea how much time I have spent on this and gotten no where. &nbsp;Thanks!!!<br />

</div>


<div>
1. No, since we do file after file ourselfs. The /T switcht would apply ACLs to files with same name in subfolders - senseless.<br />
<br />
2. I have to try that out - I will return after some hours.<br />

</div>


<div>
The correct line would be:<br />
&nbsp; &nbsp; xcacls &quot;%%F&quot; /P &quot;Authenticated Users:R&quot; &quot;Administrators:F&quot; /Y<br />
<br />
but it might be rejected, and I do not recommend this, as there are other rights necessary for services and system accounts.<br />

</div>


<div>
Qlemo! &nbsp;Your awesome! &nbsp;I agree with you that there are other rights necessary for services and system accounts. &nbsp;I wanted to add these all on manually. &nbsp;I was going to add these accounts:<br />
<br />

<ul>
<li>Administrators - Full Permissions<br />
</li>
<li>Authenticated Users - Read Only Permissions<br />
</li>
<li>Domain Admins - Full Permissions<br />
</li>
<li>System - Full Permissions<br />
</li>
<li>Photo Admin - Full Permissions - Special Security group to manage photos.</li>
</ul>
Do you suggest any others or have any advice about these?<br />
<br />
The reason I want to do this is because, when I use the /e switch I get the error in the attached photo. &nbsp;The permissions don't replicate correctly to the 2nd server if this error occurs. &nbsp;I figured out if I manually assign the permissions I don't get this error. &nbsp;I stumbled across this when you accidentally swapped the /E and /T options in one of your earlier posts. &nbsp;I'm glad you did!<br />
<br />
<a href="https://filedb.experts-exchange.com/incoming/2008/07_w30/43510/Permissions-Incorrectly-Ordered.png" target="_blank" class="file-inline" title="Permissions Incorrectly Ordered (57 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>Permissions-Incorrectly-Ordered.png</a>
</div>


Permissions-Incorrectly-Ordered.png

<div>
This message relates to deny and permit rules which are not in appropriate order. That is a problem with tools like xcacls, which can not check that on themself.<br />
I guess the error occured because to much of the access rights were removed.<br />
<br />
Those rights you listed should be enough.<br />

</div>


<div>
Qlemo! &nbsp;You have no idea how excited and thankful I am!! &nbsp;Your skills have helped me out greatly! &nbsp;I really appreciate your quick responses and the thought you put into them. &nbsp;I wish I could take you out for a beer!<br />
<br />
I'm going to test this script on the production files which are 2TB. &nbsp;This will take about 4 days to replicate all the files and then I will run the script daily after that to make sure everything is working correctly. &nbsp;I will close this question and award you the points when that is completed.<br />

</div>


<div>
While I'm waiting, I will get some real good (= German) beer ;-) Thanks for the suggestion. And good luck for your Terabytes replication.<br />

</div>


<div>
:)<br />
<br />
Update- Script is still running 2 hours after I started it. &nbsp;It actually hasn't started to change permissions yet. &nbsp;Its just sitting at a command line with no update using about 75% of the CPU constantly. &nbsp; Can you tell me what the initial part of the script does? &nbsp;Is appears that it is looking for or marking the files that will be updated and then it applies the xcacls script to those files that it found as eligible. &nbsp;Is this close at all?<br />

</div>


<div>
XCopy creates a list of ALL files first. Maybe it's a better idea to let the xcacls run once for ALL files, then the attrib, then replicate. After this, the script should work in reasonable time.<br />
<br />

<pre><code class="code-10 nolinks" id="code-20-22064637-1"><span>xcacls h:\casework\*.jpg /T </span>
<span>/P &quot;Authenticated Users:R&quot; &quot;Administrators:F&quot; /Y</span>
<span></span>
<span>attrib </span>
<span>-</span>
<span>a </span>
<span>h:\casework\*.jpg /s</span>
<span></span>
<span></span>
<span> </span>
</code></pre>
</div>


<div>
I'm just going to let it sit overnight and see if it completes. &nbsp;We'll see how it worked in the morning.<br />

</div>


<div>
SweeeeeeeeT!!!! &nbsp;It works!! &nbsp;It completed late last night. &nbsp;<br />
<br />
I have turned off replication for the moment, so that is the next thing I am going to do is enable it and make sure it replicates all the permissions correctly, but I don't think that will be an issue.<br />
<br />
Also, I added some new .jpg's this morning and then reran the script to see how long it would take. &nbsp;And it completes within 10-15min which is Awesome!!! <br />
<br />
One question I did have. &nbsp;After the script completes it says: &quot;Files Not Found - 90 File(s)&quot; &nbsp;the 90 changes... For example, when I ran it for the first time last night it said &quot;Files Not Found - 990130 File(s)&quot; &nbsp; What does this mean? &nbsp;It appears that all the files I check have had the permissions updated successfully.<br />
<br />
thank you!! thank you!!<br />
<br />

</div>


<div>
Here is a picture of the command prompt saying Files Not Found...<br />
<br />
<a href="https://filedb.experts-exchange.com/incoming/2008/07_w30/43918/Script-Results.png" target="_blank" class="file-inline" title="Script Results (23 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>Script-Results.png</a>
</div>


Script-Results.png

<div>
The message is a remnent of xcopy and should have been removed by the findstr part. I tested it with a German OS, so I could only guess what the last line of xcopy is.<br />
<br />
Just replace the word &quot;copied&quot; with &nbsp;&quot;File^(s^)&quot;, that should do.<br />

</div>


<div>
That removed the last line all together. &nbsp;Thanks!<br />

</div>


<div>
is it possible to give any kind of result, as in, how many files were processed?<br />

</div>


<div>
Hmm, we made some changes in the script till now. Could you please post the code you use so far?<br />
<br />
Generally, either we add a line before the FOR, which would be<br />
<br />
...<br />
xcopy /A /S /L h:\casework\*.jpg \ | &nbsp;findstr /c:&quot;File^(s^)&quot; &gt;&nbsp;files-processed.txt<br />
for /F ...<br />
...<br />
<br />
or we write the output of xcopy to a file, and use that file in FOR<br />
<br />
xcopy /A /S /L h:\casework\*.jpg \ &gt;&nbsp;files.txt<br />
findstr /c:&quot;File^(s^)&quot; files.txt &gt;&nbsp;files-processed.txt<br />
for /F &quot;delims=*&quot; %%F in ('findstr /v /c:&quot;File^(s^)&quot; files.txt') do ...<br />
...<br />
<br />

</div>


<div>
Here is what I am using now.<br />
<br />
<br />

<pre><code class="code-1 nolinks" id="code-124709"><span>@echo off</span>
<span>for /F &quot;delims=*&quot; %%F in ('xcopy /A /S /L h:\casework\*.jpg \ ^| findstr /v File^(s^)') do (</span>
<span>  xcacls &quot;%%F&quot; /P &quot;Authenticated Users:R&quot; &quot;Administrators:F&quot; &quot;SYSTEM:F&quot; &quot;Photo Admin:F&quot; &quot;Domain Admins:F&quot; /Y</span>
<span>  attrib -a &quot;%%F&quot;</span>
<span>)</span>
</code></pre>
</div>


<div>
Ok. let's add some luxury - date and time stamp plus files processed.<br />
<br />
<br />

<pre><code class="code-1 nolinks" id="code-124908"><span>@echo off</span>
<span> </span>
<span>xcopy /A /S /L h:\casework\*.jpg \ &gt; files.txt</span>
<span>for /F %%f in ('findstr /c:&quot;File^(s^)&quot; files.txt') do echo %date% %time% - %%f &gt;&gt; files-processed.txt</span>
<span>for /F &quot;delims=*&quot; %%F in ('findstr /v /c:&quot;File^(s^)&quot; files.txt') do (</span>
<span>  xcacls &quot;%%F&quot; /P &quot;Authenticated Users:R&quot; &quot;Administrators:F&quot; &quot;SYSTEM:F&quot; &quot;Photo Admin:F&quot; &quot;Domain Admins:F&quot; /Y</span>
<span>  attrib -a &quot;%%F&quot;</span>
<span>)</span>
</code></pre>
</div>


<div>
You might append<br />

<div class="indent">
del files.txt &gt;nul<br />

</div>
to get rid of the temp file.<br />

</div>


<div>
Oh boy, its been a long weekend and several days. &nbsp;Sorry for the delay of response. &nbsp;We hiring several new employees and that's eating up my time. &nbsp;I'm going to go through my morning routine and then I'm going to put some thought into your past several posts.<br />

</div>


<div>
I get the attached error when I run the attached code. &nbsp;I did not change anything like you mentioned in your most recent post.<br />
<br />
Also, I just figured out I have to have within this script. &nbsp;I either have to change the owner of the file or change the permissions that the owner has. &nbsp;As it is now, the owner can still delete the photos and I want to limit that. &nbsp;What is the best way to go about this?<br />
<br />

<pre><code class="code-1 nolinks" id="code-127773"><span>@echo off</span>
<span> </span>
<span>xcopy /A /S /L h:\casework\*.jpg \ &gt; files.txt</span>
<span>for /F %%f in ('findstr /c:&quot;File^(s^)&quot; files.txt') do echo %date% %time% - %%f &gt;&gt; files-processed.txt</span>
<span>for /F &quot;delims=*&quot; %%F in ('findstr /v /c:&quot;File^(s^)&quot; files.txt') do (</span>
<span>  xcacls &quot;%%F&quot; /P &quot;Authenticated Users:R&quot; &quot;Administrators:F&quot; &quot;SYSTEM:F&quot; &quot;Photo Admin:F&quot; &quot;Domain Admins:F&quot; /Y</span>
<span>  attrib -a &quot;%%F&quot;</span>
<span>)</span>
</code></pre>
<a href="https://filedb.experts-exchange.com/incoming/2008/07_w31/45665/script-error.png" target="_blank" class="file-inline" title="Script Error (16 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>script-error.png</a>
</div>


script-error.png

<div>
That error comes unexpected. I do not know at all what this could mean.<br />
<br />
I do not know how to take ownership. The owner's right will come from folder rights, I assume, but should be removed anyway by the script. Is it an inherited right after you create files in that folder?<br />

</div>


<div>
Well, I'm not to worried about the error. &nbsp;I can revert back to the script before the bells and whistles were applied. &nbsp;I do need to figure out how to change the rights of the owner, however. &nbsp;You are correct that this is applied at the folder level. &nbsp;So I realize I need to change this at the folder level. &nbsp;<br />
<br />
Consider this example:<br />
- I change the &quot;CREATOR OWNER&quot; account to have Read only permissions<br />
- The Creator of the file is Bob<br />
- Bob is also an &quot;authenticated user&quot;<br />
- &quot;Authenticated Users have full permissions on all files (except .jpg's once the script is applied nightly)<br />
<br />
Question 1? If Bob creates a doc file, will the permissions for the &quot;Authenticated Users&quot; group over ride the lower permissions of the &quot;CREATOR OWNER&quot; &nbsp;group and allow him to delete and modify the doc file he created? &nbsp;Or will he not be able to because the CREATOR OWNER group does not have this permission.<br />
<br />
Question 2? &nbsp;Bob should not be able to delete any .jpg's after the script has been applied in this scenario, correct? &nbsp;This is because the creator owner now does not have adequate permissions and authenticated users only have read on .jpg's.<br />
<br />
Thanks again for all your help!!!<br />

</div>


<div>
OK, I tried the scenario I talked about and everything seems to work great!!!! &nbsp;<br />
<br />
Also, the Error I was getting was due due to a file i had put into the same directory as the xcacls script. &nbsp;The file was named xcacls.vbs and the script was calling on that before it was the xcacls.exe. &nbsp;Anywho i removed the file and your script works! &nbsp;It outputs everything to a text file. &nbsp;However, &nbsp;I'm not sure if I will use that or not becuase .5mb everytime it runs may be a bit much. &nbsp;:)<br />
<br />
I'm starting replication tonight! &nbsp;I will let you know how everything goes!<br />

</div>


<div>
Qlemo! &nbsp;I've said it before and I'll say it again! You are amazing!! &nbsp;Everything replicated fine and the permissions are replicating wonderfully! &nbsp;I appreciate all your help with this. &nbsp;This has been, by far, my best experience on Experts Exchange to date! &nbsp;Below is the final code I am using. &nbsp;I decided against the bells and whistles and just stuck with the simple.<br />
<br />
Thank you very much!<br />
<br />

<pre><code class="code-1 nolinks" id="code-131798"><span>@echo off</span>
<span>for /F &quot;delims=*&quot; %%F in ('xcopy /A /S /L h:\casework\*.jpg \ ^| findstr /v File^(s^)') do (</span>
<span>  xcacls &quot;%%F&quot; /P &quot;Authenticated Users:R&quot; &quot;Administrators:F&quot; &quot;SYSTEM:F&quot; &quot;Photo Admin:F&quot; &quot;Domain Admins:F&quot; /Y</span>
<span>  attrib -a &quot;%%F&quot;</span>
<span>)</span>
</code></pre>
</div>


<div>
Thanks for all your help! &nbsp;This has been my best experience with EE ever! &nbsp;Cheers!
</div>


<div>
Hey Qlemo, are you still around? &nbsp;<br />
<br />
I need to make a modification to this script and could use your assistance. &nbsp;<br />
<br />
Thanks!<br />

</div>


<div>
Here is the new thread I have created.<br />
<br />
Thanks!!<br />
<br />
<a href="https://www.experts-exchange.com/questions/24659392/XCACLS-Scripting-Help.html" rel="ugc">https://www.experts-exchange.com/questions/24659392/XCACLS-Scripting-Help.html</a><br />

</div>


<div>
<div class="content wysiwyg-content">
Hi,<br />
<br />
I have, with the help of a consultant, come up with this xcacls script run as a bat file. &nbsp;I am also not very experienced with scripting or coding at all. <br />
<br />
The purpose of this script is to change the security settings on .jpg files to read only for everyone within the authenticated users group. &nbsp;This prevents users from deleting a large number of .jpg files we have (2TB). &nbsp;I will run this script nightly on the files. &nbsp;We add about 4gb of jpg files a day and I don't want this script to run on .jpg files that it has already run on. &nbsp;I only want it to run on the files that are newly added that day.<br />
<br />
Is there an if then statement I could add to this script so that it only runs on files that are added within the past day? &nbsp;Is there another way I should consider doing what I am doing? &nbsp;I am open to suggestions.<br />
<br />
Thanks for your help in advance!!!<br />

<pre><code class="code-1 nolinks" id="code-122878"><span>xcacls.exe h:\casework\*.jpg /T /E /P &quot;Authenticated Users:R&quot; /Y</span>
</code></pre>
</div>
</div>


Hi,

I have, with the help of a consultant, come up with this xcacls script run as a bat file.  I am also not very experienced with scripting or coding at all. 

The purpose of this script is to change the security settings on .jpg files to read only for everyone within the authenticated users group.  This prevents users from deleting a large number of .jpg files we have (2TB).  I will run this script nightly on the files.  We add about 4gb of jpg files a day and I don't want this script to run on .jpg files that it has already run on.  I only want it to run on the files that are newly added that day.

Is there an if then statement I could add to this script so that it only runs on files that are added within the past day?  Is there another way I should consider doing what I am doing?  I am open to suggestions.

Thanks for your help in advance!!!

XCACLS Script Help

A scripting language is a programming language that supports scripts, programs written for a special run-time environment that automate the execution of tasks that could alternatively be executed one-by-one by a human operator. Scripting languages are often interpreted (rather than compiled). Primitives are usually the elementary tasks or API calls, and the language allows them to be combined into more complex programs. Environments that can be automated through scripting include software applications, web pages within a web browser, the shells of operating systems (OS), embedded systems, as well as numerous games. A scripting language can be viewed as a domain-specific language for a particular environment; in the case of scripting an application, this is also known as an extension language.

Scripting Languages

Windows Server 2003 was based on Windows XP and was released in four editions: Web, Standard, Enterprise and Datacenter. It also had derivative versions for clusters, storage and Microsoft’s Small Business Server. Important upgrades included integrating Internet Information Services (IIS), improvements to Active Directory (AD) and Group Policy (GP), and the migration to Automated System Recovery (ASR).

Windows Server 2003

Visual Basic is Microsoft’s event-driven programming language and integrated development environment (IDE) for its Component Object Model (COM) programming model. It is relatively easy to learn and use because of its graphical development features and BASIC heritage. It has been replaced with VB.NET, and is very similar to VBA (Visual Basic for Applications), the programming language for the Microsoft Office product line.