Solved

Commmand line Windows ACLs - copy inheritance, remove group and add another group

Posted on 2010-09-17
6
1,574 Views
Last Modified: 2013-12-04
I'm in need of a simple way of setting the following on a folder. The procedure I use in the GUI is as follows::

- Stop inheritance but copy all the rights
- Remove "Users" group
- Add "Z USERS" to the ACL with everything but full control

I know xcopy can copy permissions but that proved to break very easily as it copy some unwanted ACLs from the source as well and these can be removed as the entire ACL is marked as inherited.

I would much prefer to use something that comes with XP/w2k3 or the resources kits as I have a batch script that does everything but this part.
0
Comment
Question by:saL1Las
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 
LVL 3

Expert Comment

by:latchways
ID: 33700136
Check out CACLS.exe http://ss64.com/nt/cacls.html 
0
 
LVL 3

Author Comment

by:saL1Las
ID: 33700195
I have tried CACLS and XACLS but have not been able to get them to do what I am after - I feel I missed something but any idea on the switches?
0
 
LVL 3

Accepted Solution

by:
latchways earned 200 total points
ID: 33700352
Try XCACLS.vbs http://support.microsoft.com/kb/825751 

with

xcacls.vbs <foldername> /T /E /I REMOVE /R "domain.com\domain users" /G "domain.com\z users":M
0
MS Dynamics Made Instantly Simpler

Make Your Microsoft Dynamics Investment Count  & Drastically Decrease Training Time by Providing Intuitive Step-By-Step WalkThru Tutorials.

 
LVL 3

Author Comment

by:saL1Las
ID: 33700434
Very close...but there was a typo.

xcacls.vbs <foldername> /T /E /I COPY /R "domain.com\domain users" /G "domain.com\z users":M

Should be copy and not remove.

Let me quickly throw this into a batch script and see if this works...I didn't realize there was VBS of xcacls but so long as I can integrate it into my current do it all batch script, I'm sorted.
0
 
LVL 3

Author Comment

by:saL1Las
ID: 33700652
I've tested it in my master script and for those who'd like to know please do the following:

Please xcacls.exe and XACLS.vbs on a file share that can be accessed and in the same folder.

To copy inheritance, remove specific permission and then add your own with all but full access:

cscript "\\myserver\myshare\myfolder\xcacls.vbs" <foldername> /T /E /I COPY /R "domain.com\domain users" /G "domain.com\z users":M

If you want to be explicity, replace the M at the end with one of the following:
F  Full control
M  Modify
X  read & eXecute
L  List folder contents
R  Read
W  Write

Alternatively, if you want to keep the inheritance as is and just add a security group, change copy to enable:

cscript "\\myserver\myshare\myfolder\xcacls.vbs" <foldername> /T /E /I ENABLE /R "domain.com\domain users" /G "domain.com\z users":M

You can add /Q to the end of either of the above to suppress all the text.

If you need to check for more options

cscript "\\myserver\myshare\myfolder\xcacls.vbs" /?

Sorted!
0
 
LVL 3

Author Closing Comment

by:saL1Las
ID: 33700668
See my last post for full solution.
0

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
This article was originally published on Monitis Blog, you can check it here . Today it’s fairly well known that high-performing websites and applications bring in more visitors, higher SEO, and ultimately more sales. By the same token, downtime…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question