Setting permissions on a folder and pushing them down

[FatBoy]

Hi all,

I have been trying to get a script working so that it changes the permissions on a installed program folder (Oxford University Press) so that everyone has read/write permissions to it (Otherwise only admins can run the program). So far I, with a lot of help have this:

varfolder = "c:\Program Files\Oxford University Press"

SET fs = WScript.CreateObject("Scripting.FileSystemObject")
SET WshShell = CreateObject("WScript.Shell")

If NOT fs.FolderExists(varfolder & "\ok.txt") then 'checks if code should run
fs.CopyFile "\\servername\share\eSongbirds\MSI\ADsSecurity.dll ", "C:\WINDOWS\system32\" 'copies dll over to PC
fs.CopyFile "\\servername\share\eSongbirds\MSI\ok.txt", "c:\Program Files\Oxford University Press\" 'copies ok.txt to folder
WshShell.run "regsvr32 /s C:\WINDOWS\system32\ADsSecurity.dll", True 'registers the dll

SET objsecurity = createobject("adssecurity") 'invokes the dll
SET objsd = objsecurity.getsecuritydescriptor("file://" & varfolder) 'picks up varfolder
SET objdacl = objsd.discretionaryacl 'creates acl

SET objnewace = createobject("accesscontrolentry") ' makes the ace

objnewace.trustee = "Everyone" 'who your assigning permission to
objnewace.accessmask = 2032127 ' full control
objnewace.acetype = acetype_access_allowed
objnewace.aceflags = 3 ' files folders and subfolders
objdacl.addace objnewace 'adds ace to acl

objsd.discretionaryacl = objdacl
objsecurity.setsecuritydescriptor objsd

else
msgbox("no folder exist")
End if

It all works ok apart from it doesn't push the permissons down to the folders and files below, it only adds everyone to the root folder (Oxford University Press) I thought the "objnewace.aceflags = 3" code would do it but it doesn't can anyone help?

Thanks

[AliG]

You could use GPO for this too. Computer Config - Windows settings - Security Settings - File system. If the path does not exist on the server/pc you are editing GPO on just create a dummy folder of it.

Enjoy!

[srochford]

I'd definitely do it with the GPO but the script that I've used in the past uses value 2 (ADS_ACEFLAG_INHERIT_ACE) to get the perms inherited.

The MSDN website gives the definitions of the various flag constants.

[FatBoy]

Thanks AliG thats spot on never new about this policy cheers for the info also srochford

[TechSupp]

eSongbirds! I recently had the fun job of installing that one around the school. I just made an msi for all the disks and then pushed it out. Didn't have the same trouble as you as we have other progs that require local admin rights to run Grrrr... Good to see that scripts as I may need something like that in the future.

[buzzard]

Defo use the GPO much simpler to manage, but beware this can easily be applied to the entire network rather then the few computers you want! Just use the security filtering on the GP to narrow down where it applies.