Solved

Modify File Permissions With Startup Script

Posted on 2008-10-14
11
975 Views
Last Modified: 2012-06-22
Hi experts,

By way of a script, I need to create a couple of folders in the root of workstation C: drives, and then set the permissions so that Domain Users have Modify permissions. I need this to all happen on the first login.

I have written a startup script which succesfully creates the folders, but I can't set the permissions. I am using the following to set the permissions:

objShell.Run("%COMSPEC% /c cacls C:\<FOLDERNAME> /T /E /G BUILTIN\Users:C")

It's not working though. I am assuming it's a permissions problem with the computer account not being able to set the permissions. I know I can set the file permissions using a GPO, but I need this all to be on first login, and at the time of the GPO being processed the first time around, the folders won't exist for the permissions to be set (as the script hasn't yet ran) so I can't get this to work.

Does anyone have any suggestions on how I can allow the file permissions to be set during startup, immediately after they are created?

Thanks,

0
Comment
Question by:gcz
  • 4
  • 3
  • 2
  • +1
11 Comments
 
LVL 9

Expert Comment

by:gregcmcse
Comment Utility
Does SYSTEM have full control to C:?

You may need to specify the full path to cacls.exe and remove the %COMSPEC% reference.  I'm not sure that startup scripts running under the system context have access to environment variables.
0
 
LVL 1

Author Comment

by:gcz
Comment Utility
Hi,

Thanks for the quick reply. SYSTEM does have Full Control of C: and this is being inherited by it's subfolders.

I changed the command to read...

objShell.Run("C:\WINDOWS\System32\cmd.exe /c cacls C:\quitsbas /T /E /G BUILTIN\Users:C")

...but this still hasn't worked unfortunately. I do not know a lot about this, but under what context do startup scripts run in? Is it SYSTEM, or the computer account? (i.e. computername$).

Unfortunately I can't seem to get the command prompt window to stay on the screen long enough for me to definately read what the error is. I've tried the cmd /k switch, and also tried adding '&& pause' to the end of the above command, but neither work.

Any ideas? Thanks.
0
 
LVL 14

Expert Comment

by:igor-1965
Comment Utility
Quite logically any login script runs in the context of the user who is logging. I presume, when the folder created it inherits the permissions of the root (C: drive). CREATOR OWNER has Full Permissions so it is probably critical to create folder and set permissions in one script.
0
 
LVL 1

Author Comment

by:gcz
Comment Utility
Hi,

The script in question is a Startup script, not a login script, so before any user has logged in.

I believe that these run under the context of SYSTEM or the AD computer account (I think depending on whether network permissions are required).

Actually, thinking about it, before I create the folders, I am mapping per-machine printer connections, so I would assume the script is operating under the AD computer account context, otherwise the mapping of printers wouldn't be possible.

I have tried granting the AD computer account full control, but this doesn't seem to make a difference.

I'm pretty stumped now, please help!

0
 
LVL 14

Expert Comment

by:igor-1965
Comment Utility
Have you considered to use Xcacls.vbs http://support.microsoft.com/kb/825751/en-us
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 
LVL 9

Accepted Solution

by:
gregcmcse earned 500 total points
Comment Utility
The COMPUTERNAME$ account is how the domain sees it.  It sees itself as SYSTEM.  So, is it COMPUTERNAME$ or SYSTEM?  Yes, it's both.

You don't want to run cmd.exe -- it won't gain you anything as cacls.exe isn't an internal command.

Try:
objShell.Run("C:\WINDOWS\System32\cacls.exe C:\quitsbas /T /E /G BUILTIN\Users:C")

(That assumes the syntax of the cacls command is correct, by the way -- I assume you've run the cacls command separately to confirm correct syntax?)
0
 
LVL 65

Expert Comment

by:RobSampson
Comment Utility
Hi, you can just use Group Policy (if you're in an Active Directory domain) to apply registry and file system security settings....

http://network.mpei.ac.ru/lang/rus/faqw2kxp/jsifaq/rh8724.htm

Regards,

Rob.
0
 
LVL 9

Expert Comment

by:gregcmcse
Comment Utility
Rob -- gcz has already indicated that a GPO won't work for his needs.

gcz:  How are things going?
0
 
LVL 65

Expert Comment

by:RobSampson
Comment Utility
>> Rob -- gcz has already indicated that a GPO won't work for his needs.

Oh yeah, sorry, my bad......

XCacls.vbs is a bit more robust than Cacls.exe, but you could also try SetACL.exe:
http://setacl.sourceforge.net/html/examples.html

or it even comes as an ActiveX, although I haven't tried that...

Regards,

Rob.
0
 
LVL 1

Author Comment

by:gcz
Comment Utility
Hi Guys,

Thanks for the posts, and sorry for the delay in getting back - I was out of the office yesterday.

Greg - this worked a treat, thanks! I actually don't know why I was calling cmd.exe as looking at it now it's obviously not necessary. Running cacls.exe directly worked fine.

Thank you.

Tony
0
 
LVL 1

Author Closing Comment

by:gcz
Comment Utility
Thanks for explaining the SYSTEM/COMPUTERNAME$ also...
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

This script will sweep a range of IP addresses (class c only, 255.255.255.0) and report to a log the version of office installed. What it does: 1.)      Creates log file in the directory the script is run from (if it doesn't already exist) 2.)      Sweep…
This article is the result of a quest to better understand Task Scheduler 2.0 and all the newer objects available in vbscript in this version over  the limited options we had scripting in Task Scheduler 1.0.  As I started my journey of knowledge I f…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now