Solved

Windows 2008 - Permissions on Folder are incorrectly ordered

Posted on 2009-05-03
7
3,784 Views
Last Modified: 2012-05-06
I am currently having an issue with CACL permissions in Windows 2008 Enterprise Server. I have a vbscript that run nightly to populate/create department folder on a SAN File cluster. The department folders are based on the department OU's in Active Directory. The department folders and permissions on the root department folders are created with no issues.
The issue that arises is with the sub-folders within the root department folders. Anytime a subfolder is created and a user goes to properties, and the security tab the following error appears: "The permissions on "folder name" are incorrectly ordered, which may cause some entries to be ineffective." As a reminder, this error only occurs on the sub-folders not the root department folders.
I do not believe there is an issue with the script. I realize that there is a known bug with incorrectly ordered permissions, but I can only find information on Windows 2000, and XP.
I need to know if there is a patch to resolve this issue for Windows 2008.

Thanks,
PulsarSolutions
VBScript code: 

(CACLS Section Only)
 

'========================================================================================
 

Function Permissions()

'Department group name with no spaces between the Department name & group

strFolderGroup = strFolder & "Group"

strFolderGroup = Replace(strFolderGroup,"_"," ")
 

'Department group name with a space between the department name & group

'strFolderGroup2 = strText & " Group"

strFolderGroup2 = strFolder & " Group"

strFolderGroup2 = Replace(strFolderGroup2,"_"," ")

 

Set objShell   = CreateObject("Wscript.Shell")

Set object2FSO = CreateObject("Scripting.FileSystemObject")
 

If object2FSO.FolderExists(strFolderPath) Then

	intRunError = objShell.Run("%COMSPEC% /c Echo Y| cacls "	&	_

	"""" & strFolderPath & """"	&	_

	" /e /t /c /g """ & strFolderGroup & """:F", 2, True)
 

	If intRunError <> 0 Then

	    'If error applying strFolderGroup group permissions to department folder

	    'Attempt to apply strFolderGroup2 group permission to department folder

	    If object2FSO.FolderExists(strFolderPath) Then

			intRunError = objShell.Run("%COMSPEC% /c Echo Y| cacls "	&	_

			"""" & strFolderPath & """"	&	_

			" /e /t /c /g """ & strFolderGroup2 & """:F", 2, True)

			

				'If unable to apply strFolderGroup & strFolderGroup2 then log an error message

				If intRunError <> 0 Then

					WScript.Echo "Error assigning permissions for: " & strFolderGroup1 & strFolderGroup2

					objLogFile.WriteLine "Error assigning permissions for: " & strFolderGroup1 & strFolderGroup2

				Else

				   	'Log strFolderGroup2 was successfully applied

				   	WScript.Echo strFolderGroup2 & " permissions applied successfully"

				    objLogFile.WriteLine strFolderGroup2 & " permissions applied successfully"

				End If

							

         End If

	Else

			'Log strFolderGroup was successfully applied

			WScript.Echo strFolderGroup & " permissions applied successfully"

			objLogFile.WriteLine strFolderGroup & " permissions applied successfully"				

	End If

End If

End Function

Open in new window

0
Comment
Question by:pulsarsolutions
  • 6
7 Comments
 
LVL 41

Assisted Solution

by:graye
graye earned 20 total points
ID: 24292380
I'd recommend that you switch to using ICACLS (it's the latest version of the tool for Vista, 2008, etc)
The command line syntax is a bit different...  http://technet.microsoft.com/en-us/library/cc753525.aspx
0
 

Author Comment

by:pulsarsolutions
ID: 24295038
I will write a separate icacls test script and see it resolves the problem. I will provide an update shortly.
0
 

Author Comment

by:pulsarsolutions
ID: 24297032
I have not had much luck locating any sample vbscript code for using icacls versus cacls. Does anyone have any example vbscript code for ICACLS?
0
Too many email signature changes to deal with?

Are you constantly being asked to update your organization's email signatures? Do they take up too much of your time? Wouldn't you love to be able to manage all signatures from one central location, easily design them and deploy them quickly to users. Well, you can!

 

Author Comment

by:pulsarsolutions
ID: 24297228
The following works in a command line, but still working on correct syntax to apply via vbscript:
icacls sales_folder /grant fileadmins:(OI)f /T /C (command line)

0
 

Author Comment

by:pulsarsolutions
ID: 24297282
I believe I have the vbscript code method to run it via vbscript:

Set objShell   = CreateObject("Wscript.Shell")
intRunError = objShell.Run("icacls sales_folder /grant fileadmins:(OI)f /T /C")

I will now need to test it in the environment to see if it resolves the issue. I will provide an update
shortly.
0
 

Accepted Solution

by:
pulsarsolutions earned 0 total points
ID: 24301188
The issue is resolved. Using ICACLS resolved the issue. I will provide my permissions function that includes the ICACLS logic.

Thanks for the suggestion!
Function Permissions()

'Department group name with no spaces between the Department name & group

strFolderGroup = strFolder & "Group"

strFolderGroup = Replace(strFolderGroup,"_"," ")
 

'Department group name with a space between the department name & group

'strFolderGroup2 = strText & " Group"

strFolderGroup2 = strFolder & " Group"

strFolderGroup2 = Replace(strFolderGroup2,"_"," ")

 

Set objShell   = CreateObject("Wscript.Shell")

Set object2FSO = CreateObject("Scripting.FileSystemObject")
 

If object2FSO.FolderExists(strFolderPath) Then

	intRunError = objShell.Run("icacls """ & strFolderPath & """ /grant """ & strFolderGroup & """:(OI)(CI)f /T /C")

		     

	If intRunError <> 0 Then

	    

	    If object2FSO.FolderExists(strFolderPath) Then

			intRunError = objShell.Run("icacls """ & strFolderPath & """ /grant """ & strFolderGroup2 & """:(OI)(CI)f /T /C")

		

			 'If unable to apply strFolderGroup & strFolderGroup2 then log an error message

				If intRunError <> 0 Then

					WScript.Echo "Error assigning permissions for: " & strFolderGroup1 & strFolderGroup2

					objLogFile.WriteLine "Error assigning permissions for: " & strFolderGroup1 & strFolderGroup2

				Else

				   	'Log strFolderGroup2 was successfully applied

				   	WScript.Echo strFolderGroup2 & " permissions applied successfully"

				    objLogFile.WriteLine strFolderGroup2 & " permissions applied successfully"

				End If

							

         End If

	Else

			'Log strFolderGroup was successfully applied

			WScript.Echo strFolderGroup & " permissions applied successfully"

			objLogFile.WriteLine strFolderGroup & " permissions applied successfully"				

	End If

End If

End Function

Open in new window

0
 

Author Comment

by:pulsarsolutions
ID: 24301206
ICACLS code resolved the issue:

Function Permissions()
'Department group name with no spaces between the Department name & group
strFolderGroup = strFolder & "Group"
strFolderGroup = Replace(strFolderGroup,"_"," ")

'Department group name with a space between the department name & group
'strFolderGroup2 = strText & " Group"
strFolderGroup2 = strFolder & " Group"
strFolderGroup2 = Replace(strFolderGroup2,"_"," ")
 
Set objShell   = CreateObject("Wscript.Shell")
Set object2FSO = CreateObject("Scripting.FileSystemObject")

If object2FSO.FolderExists(strFolderPath) Then
      intRunError = objShell.Run("icacls """ & strFolderPath & """ /grant """ & strFolderGroup & """:(OI)(CI)f /T /C")
                 
      If intRunError <> 0 Then
          
          If object2FSO.FolderExists(strFolderPath) Then
                  intRunError = objShell.Run("icacls """ & strFolderPath & """ /grant """ & strFolderGroup2 & """:(OI)(CI)f /T /C")
            
                   'If unable to apply strFolderGroup & strFolderGroup2 then log an error message
                        If intRunError <> 0 Then
                              WScript.Echo "Error assigning permissions for: " & strFolderGroup1 & strFolderGroup2
                              objLogFile.WriteLine "Error assigning permissions for: " & strFolderGroup1 & strFolderGroup2
                        Else
                                 'Log strFolderGroup2 was successfully applied
                                 WScript.Echo strFolderGroup2 & " permissions applied successfully"
                            objLogFile.WriteLine strFolderGroup2 & " permissions applied successfully"
                        End If
                                          
         End If
      Else
                  'Log strFolderGroup was successfully applied
                  WScript.Echo strFolderGroup & " permissions applied successfully"
                  objLogFile.WriteLine strFolderGroup & " permissions applied successfully"                        
      End If
End If
End Function
0

Featured Post

Don't lose your head updating email signatures!

Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users do...so should you!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Ways to verify USB ports are blocked on 30,000 PCs/laptops 12 114
acrobat scan error 4 45
adobe premier render 10 38
DNS Setup 6 26
Recently Microsoft released a brand new function called CONCAT. It's supposed to replace its predecessor CONCATENATE. But how does it work? And what's new? In this article, we take a closer look at all of this - we even included an exercise file for…
A Bare Metal Image backup allows for the restore of an entire system to a similar or dissimilar hardware. They are highly useful for migrations and disaster recovery. Bare Metal Image backups support Full and Incremental backups. Differential backup…
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now