Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1013
  • Last Modified:

Modify File Permissions With Startup Script

Hi experts,

By way of a script, I need to create a couple of folders in the root of workstation C: drives, and then set the permissions so that Domain Users have Modify permissions. I need this to all happen on the first login.

I have written a startup script which succesfully creates the folders, but I can't set the permissions. I am using the following to set the permissions:

objShell.Run("%COMSPEC% /c cacls C:\<FOLDERNAME> /T /E /G BUILTIN\Users:C")

It's not working though. I am assuming it's a permissions problem with the computer account not being able to set the permissions. I know I can set the file permissions using a GPO, but I need this all to be on first login, and at the time of the GPO being processed the first time around, the folders won't exist for the permissions to be set (as the script hasn't yet ran) so I can't get this to work.

Does anyone have any suggestions on how I can allow the file permissions to be set during startup, immediately after they are created?

Thanks,

0
gcz
Asked:
gcz
  • 4
  • 3
  • 2
  • +1
1 Solution
 
gregcmcseCommented:
Does SYSTEM have full control to C:?

You may need to specify the full path to cacls.exe and remove the %COMSPEC% reference.  I'm not sure that startup scripts running under the system context have access to environment variables.
0
 
gczAuthor Commented:
Hi,

Thanks for the quick reply. SYSTEM does have Full Control of C: and this is being inherited by it's subfolders.

I changed the command to read...

objShell.Run("C:\WINDOWS\System32\cmd.exe /c cacls C:\quitsbas /T /E /G BUILTIN\Users:C")

...but this still hasn't worked unfortunately. I do not know a lot about this, but under what context do startup scripts run in? Is it SYSTEM, or the computer account? (i.e. computername$).

Unfortunately I can't seem to get the command prompt window to stay on the screen long enough for me to definately read what the error is. I've tried the cmd /k switch, and also tried adding '&& pause' to the end of the above command, but neither work.

Any ideas? Thanks.
0
 
igor-1965Commented:
Quite logically any login script runs in the context of the user who is logging. I presume, when the folder created it inherits the permissions of the root (C: drive). CREATOR OWNER has Full Permissions so it is probably critical to create folder and set permissions in one script.
0
Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
gczAuthor Commented:
Hi,

The script in question is a Startup script, not a login script, so before any user has logged in.

I believe that these run under the context of SYSTEM or the AD computer account (I think depending on whether network permissions are required).

Actually, thinking about it, before I create the folders, I am mapping per-machine printer connections, so I would assume the script is operating under the AD computer account context, otherwise the mapping of printers wouldn't be possible.

I have tried granting the AD computer account full control, but this doesn't seem to make a difference.

I'm pretty stumped now, please help!

0
 
igor-1965Commented:
Have you considered to use Xcacls.vbs http://support.microsoft.com/kb/825751/en-us
0
 
gregcmcseCommented:
The COMPUTERNAME$ account is how the domain sees it.  It sees itself as SYSTEM.  So, is it COMPUTERNAME$ or SYSTEM?  Yes, it's both.

You don't want to run cmd.exe -- it won't gain you anything as cacls.exe isn't an internal command.

Try:
objShell.Run("C:\WINDOWS\System32\cacls.exe C:\quitsbas /T /E /G BUILTIN\Users:C")

(That assumes the syntax of the cacls command is correct, by the way -- I assume you've run the cacls command separately to confirm correct syntax?)
0
 
RobSampsonCommented:
Hi, you can just use Group Policy (if you're in an Active Directory domain) to apply registry and file system security settings....

http://network.mpei.ac.ru/lang/rus/faqw2kxp/jsifaq/rh8724.htm

Regards,

Rob.
0
 
gregcmcseCommented:
Rob -- gcz has already indicated that a GPO won't work for his needs.

gcz:  How are things going?
0
 
RobSampsonCommented:
>> Rob -- gcz has already indicated that a GPO won't work for his needs.

Oh yeah, sorry, my bad......

XCacls.vbs is a bit more robust than Cacls.exe, but you could also try SetACL.exe:
http://setacl.sourceforge.net/html/examples.html

or it even comes as an ActiveX, although I haven't tried that...

Regards,

Rob.
0
 
gczAuthor Commented:
Hi Guys,

Thanks for the posts, and sorry for the delay in getting back - I was out of the office yesterday.

Greg - this worked a treat, thanks! I actually don't know why I was calling cmd.exe as looking at it now it's obviously not necessary. Running cacls.exe directly worked fine.

Thank you.

Tony
0
 
gczAuthor Commented:
Thanks for explaining the SYSTEM/COMPUTERNAME$ also...
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 4
  • 3
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now