Link to home
Start Free TrialLog in
Avatar of gcz
gczFlag for United Kingdom of Great Britain and Northern Ireland

asked on

Modify File Permissions With Startup Script

Hi experts,

By way of a script, I need to create a couple of folders in the root of workstation C: drives, and then set the permissions so that Domain Users have Modify permissions. I need this to all happen on the first login.

I have written a startup script which succesfully creates the folders, but I can't set the permissions. I am using the following to set the permissions:

objShell.Run("%COMSPEC% /c cacls C:\<FOLDERNAME> /T /E /G BUILTIN\Users:C")

It's not working though. I am assuming it's a permissions problem with the computer account not being able to set the permissions. I know I can set the file permissions using a GPO, but I need this all to be on first login, and at the time of the GPO being processed the first time around, the folders won't exist for the permissions to be set (as the script hasn't yet ran) so I can't get this to work.

Does anyone have any suggestions on how I can allow the file permissions to be set during startup, immediately after they are created?

Thanks,

Avatar of gregcmcse
gregcmcse
Flag of United States of America image

Does SYSTEM have full control to C:?

You may need to specify the full path to cacls.exe and remove the %COMSPEC% reference.  I'm not sure that startup scripts running under the system context have access to environment variables.
Avatar of gcz

ASKER

Hi,

Thanks for the quick reply. SYSTEM does have Full Control of C: and this is being inherited by it's subfolders.

I changed the command to read...

objShell.Run("C:\WINDOWS\System32\cmd.exe /c cacls C:\quitsbas /T /E /G BUILTIN\Users:C")

...but this still hasn't worked unfortunately. I do not know a lot about this, but under what context do startup scripts run in? Is it SYSTEM, or the computer account? (i.e. computername$).

Unfortunately I can't seem to get the command prompt window to stay on the screen long enough for me to definately read what the error is. I've tried the cmd /k switch, and also tried adding '&& pause' to the end of the above command, but neither work.

Any ideas? Thanks.
Quite logically any login script runs in the context of the user who is logging. I presume, when the folder created it inherits the permissions of the root (C: drive). CREATOR OWNER has Full Permissions so it is probably critical to create folder and set permissions in one script.
Avatar of gcz

ASKER

Hi,

The script in question is a Startup script, not a login script, so before any user has logged in.

I believe that these run under the context of SYSTEM or the AD computer account (I think depending on whether network permissions are required).

Actually, thinking about it, before I create the folders, I am mapping per-machine printer connections, so I would assume the script is operating under the AD computer account context, otherwise the mapping of printers wouldn't be possible.

I have tried granting the AD computer account full control, but this doesn't seem to make a difference.

I'm pretty stumped now, please help!

Have you considered to use Xcacls.vbs http://support.microsoft.com/kb/825751/en-us
ASKER CERTIFIED SOLUTION
Avatar of gregcmcse
gregcmcse
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of RobSampson
Hi, you can just use Group Policy (if you're in an Active Directory domain) to apply registry and file system security settings....

http://network.mpei.ac.ru/lang/rus/faqw2kxp/jsifaq/rh8724.htm

Regards,

Rob.
Rob -- gcz has already indicated that a GPO won't work for his needs.

gcz:  How are things going?
>> Rob -- gcz has already indicated that a GPO won't work for his needs.

Oh yeah, sorry, my bad......

XCacls.vbs is a bit more robust than Cacls.exe, but you could also try SetACL.exe:
http://setacl.sourceforge.net/html/examples.html

or it even comes as an ActiveX, although I haven't tried that...

Regards,

Rob.
Avatar of gcz

ASKER

Hi Guys,

Thanks for the posts, and sorry for the delay in getting back - I was out of the office yesterday.

Greg - this worked a treat, thanks! I actually don't know why I was calling cmd.exe as looking at it now it's obviously not necessary. Running cacls.exe directly worked fine.

Thank you.

Tony
Avatar of gcz

ASKER

Thanks for explaining the SYSTEM/COMPUTERNAME$ also...