Solved

Commmand line Windows ACLs - copy inheritance, remove group and add another group

Posted on 2010-09-17
6
1,568 Views
Last Modified: 2013-12-04
I'm in need of a simple way of setting the following on a folder. The procedure I use in the GUI is as follows::

- Stop inheritance but copy all the rights
- Remove "Users" group
- Add "Z USERS" to the ACL with everything but full control

I know xcopy can copy permissions but that proved to break very easily as it copy some unwanted ACLs from the source as well and these can be removed as the entire ACL is marked as inherited.

I would much prefer to use something that comes with XP/w2k3 or the resources kits as I have a batch script that does everything but this part.
0
Comment
Question by:saL1Las
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 
LVL 3

Expert Comment

by:latchways
ID: 33700136
Check out CACLS.exe http://ss64.com/nt/cacls.html 
0
 
LVL 3

Author Comment

by:saL1Las
ID: 33700195
I have tried CACLS and XACLS but have not been able to get them to do what I am after - I feel I missed something but any idea on the switches?
0
 
LVL 3

Accepted Solution

by:
latchways earned 200 total points
ID: 33700352
Try XCACLS.vbs http://support.microsoft.com/kb/825751 

with

xcacls.vbs <foldername> /T /E /I REMOVE /R "domain.com\domain users" /G "domain.com\z users":M
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 
LVL 3

Author Comment

by:saL1Las
ID: 33700434
Very close...but there was a typo.

xcacls.vbs <foldername> /T /E /I COPY /R "domain.com\domain users" /G "domain.com\z users":M

Should be copy and not remove.

Let me quickly throw this into a batch script and see if this works...I didn't realize there was VBS of xcacls but so long as I can integrate it into my current do it all batch script, I'm sorted.
0
 
LVL 3

Author Comment

by:saL1Las
ID: 33700652
I've tested it in my master script and for those who'd like to know please do the following:

Please xcacls.exe and XACLS.vbs on a file share that can be accessed and in the same folder.

To copy inheritance, remove specific permission and then add your own with all but full access:

cscript "\\myserver\myshare\myfolder\xcacls.vbs" <foldername> /T /E /I COPY /R "domain.com\domain users" /G "domain.com\z users":M

If you want to be explicity, replace the M at the end with one of the following:
F  Full control
M  Modify
X  read & eXecute
L  List folder contents
R  Read
W  Write

Alternatively, if you want to keep the inheritance as is and just add a security group, change copy to enable:

cscript "\\myserver\myshare\myfolder\xcacls.vbs" <foldername> /T /E /I ENABLE /R "domain.com\domain users" /G "domain.com\z users":M

You can add /Q to the end of either of the above to suppress all the text.

If you need to check for more options

cscript "\\myserver\myshare\myfolder\xcacls.vbs" /?

Sorted!
0
 
LVL 3

Author Closing Comment

by:saL1Las
ID: 33700668
See my last post for full solution.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Compromised PC? 17 250
Risks of using Camtasia Studio 9 137
Best alternatives to Solarwinds 14 83
Linux Real Time Memory on Distinct 24 Cycle 7 43
Many of us in IT utilize a combination of roaming profiles and folder redirection to ensure user information carries over from one workstation to another; in my environment, it was to enable virtualization without needing a separate desktop for each…
Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question