Solved

Script to change file permissions on Server 2003

Posted on 2011-10-26
191 Views
We're trying to set up a script to modify permissions on a whole ton of folders, 850 to be exact.  It's an HR_Data folder at the top level underneath which there is an Active Employees subfolder.  Under that is the 850 folders, one for each employee.  Inside those is 3 subfolders: HR, Training, and Safety.  We have two groups that need permissions to these.  Setting up the permissions on the 850 folders is easy since each has the same permission, I'm highlighting all of them, right-clicking and changing the permissions to add read and execute for these two groups.  But the complication comes in with the 3 subfolders:

Group1 - modify on HR subfolder
Group2 - deny everything on HR subfolder

Group1 - deny everything on Training and Safety subfolders.
Group2 - modify on Training and Safety subfolders.

Rather than go into every one of the 850 folders and modify the permissions on the subfolders manually, is there some script that can do this?  I've been looking at cacls.exe but can't get it to work on a test folder I have.
0
Question by:sedberg1
1 Comment

LVL 38

Accepted Solution

NTFS permissions can be tricky, you have to remember that the most restrictive permission is the one that will apply, especially when there is a conflict in those permissions.
User_1 is in HR's Group, and the Domain_Users group.
If you give the HR-Group full control of a folder, but the domain_users have read only, if user1 goes to modify something, he/she will be denied because user1 is in the domain_users group, and that group has the most restrictive permission(read only). This is where the "effective permissions" tab can help you understand. Remember just because you give a permission to someone/group, it will not "over-ride" a deny permission from another group. Direct permissions (giving a specific user full control for example) will "over-ride".
You could probably use a simple text editor like Notepad++ or even Excel !-)
In excel...
A                    B                               C                        D                        E                 F
calcs.exe || \\path\to\HR_data\ || %username% || \HR /T /C /E /G || %username%|| :F
Copy that over and over(or drag the corner of the cell to replicate) copy the usernames into the variable %username% columns (C and E), copy and past all that into a text file, rename to batch, double click. you can put a group in column E if you wish...

"cacls.exe \\path\to\HR_data\user_1\HR /T /C /E /G user_1:F"
or
"cacls.exe \\path\to\HR_data\user_1\HR /T /C /E /G group_1:F"
-rich

REM This is a basic logon script you could use...
@Echo OFF
if exist cacls.exe \\path\to\HR_data\%username%\HR /T /C /E /G %username%:F
:End

0

Join & Write a Comment Already a member? Login.

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!