Solved

Via GPO add local group to ACL for a file

Posted on 2010-09-10
3
550 Views
Last Modified: 2012-06-21
On each domain member PC there is a local group called "specialUsers". They each have their own local SID as they were created with a locally run script. The group contains domain groups and domain users and local users.

We want to give that group permissions on a file local to that PC. For example, give it "deny full control" to "file1.txt" so that if you're a local user in that group or a domain user in the domain group which is a member of that local group, you cannot do anything to that file, even read it's contents.

Via GPO we have lots of file security permissions. We have common SID users and groups having or being denied access (like Administrators, Remote Desktop Users, SYSTEM, etc). If I back up the GPO and go to the GptTmpl.inf file I can see these ACL's listed under [File Security].

However I can't figure out how to create an entry that sets permissions to that local file on eac pc to the local group on that PC. I can't copy and paste one of the file entry lines and put in the SID of the local group because that SID doesn't exist on other PCs, only that one. I can't put just the display name instead of the SID (such as "Special Users" because when you try to restore that gpttmpl file or import it, it errors out.

Anyone have an idea on how to via group policy force each pc to add certain restrictions to a file for the same local group name even though the SIDs are different?

Thanks.
0
Comment
Question by:MrSampsonite
  • 2
3 Comments
 
LVL 31

Accepted Solution

by:
Justin Owens earned 500 total points
ID: 33663208
Would you be willing to use GPO to fire off a batch file?  If so, you could use the icacls command like to do this very easily:

icacls file1.txt  /deny specialUsers:F

Source for icacls, if you need it: http://technet.microsoft.com/en-us/library/cc753525%28WS.10%29.aspx 
0
 

Author Comment

by:MrSampsonite
ID: 33772403
It looks like your solution may be the only option. Thanks for the link.
0
 

Author Closing Comment

by:MrSampsonite
ID: 33772407
only solution given was to create a batch file as it appears impossible via gpo.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question