Script to change NTFS permissions

[FN-GM]

Hi,

I need a script that will give a group called btc\staff_sims_updates full permissions on the sims folder in program files.

I wonder if someone cna help

Thanks

[MattCrick]

cacls "C:\program files\SIMS" /E /T /C /G "btc\staff_sims_updates":C

in a batch file or as part of your logon script

Works for us...

Matt

[SYNACK]

If this is for client machines just use the file system security bit in a GPO which results in a much cleaner implementation and does not require any scripting at all.

applying folder permissions through group policy

computer configuration/windows settings/security settings/file system

Right click add file, then you browse to the folder (if it is being done on the server and the folder is not there cerate it so you can find the path then you can set the permissions by double clicking the folder in the file system

[FN-GM]

Hi,
I have altered it so it will give full permisions and remove existing groups here is my code

"C:\program files\SIMS" /T /C /G "btc\staff_sims_updates":f

but it is prompting for a yes or no. How would i make it so it automatically says yes?

thanks

[dwhyte85]

Here is a snippet of something that does similar that i modified, some vars aren't needed but you get the idea, could alter as needed:

Dim objFSO
Set objFSO = CreateObject("Scripting.FileSystemObject")
dim pos
Set objRoot = GetObject("LDAP://RootDSE") 
strDNC = objRoot.Get("DefaultNamingContext") 
Set objDomain = GetObject("LDAP://" & strDNC) ' Bind to the top of the Domain using LDAP using ROotDSE 
Dim fso
Set fso = CreateObject("Scripting.FileSystemObject")
Set wshShell = WScript.CreateObject ("WSCript.shell")

''''''''''''''''''''''''''''
Call enummembers(objDomain)'
''''''''''''''''''''''''''''

Sub enumMembers(objDomain) 
On Error Resume Next 

For Each objMember In objDomain ' go through the collection 



If ObjMember.Class = "user" Then 

SamAccountName = ObjMember.samAccountName 


strDetail = "xcacls a:\path-to-folder /e /g "&SamAccountName&":F /y"
wshshell.run strDetail,7, true

''''''''''''''''''

If objMember.Class = "organizationalUnit" or OBjMember.Class = "container" Then 
strDetail = objmember.adspath
pos=InStr(1,strDetail,"SOME-OU",0) 
if pos > 0 then
      enumMembers (objMember) 
 
end if
end if

the 2 bolded bits are important, first one is path to folder that you want to add NTFS permissions, latter is to enumerate through an OU on AD, so you could go through the 'teachers' OU when ran on the DC, well i invoke through a scheduled task and it does something slightly different - similar in principal! This was made for something tottallly different but not alot of difference in what it does.

[MattCrick]

Modify perms should be sufficient to enable the user to update SIMS.

[notalot]

If your trying to get users to update sims without being an admin i bleave there is a bat in sims\setups called simsperm you use it like this if its there

I:\Sims\Setups\Simsperm.bat "Domain\Group"

where I:\ is the share for your sims server

[box_l]

i do the above (simsperms.bat), but i use mine as a startupscript in a gpo for the staff workstations.


Create new group policy called simsperms
Go to windows startup scripts (machine settings)
Click Show files
Paste in subinacl.exe and the .bat file
Copy path from the window
Eg.

\\schoolname.county.sch.uk\SysVol\schoolname.county.sch.uk\Policies\{5BB037E4-9025-4685-A436-5D003B249635}\Machine\Scripts\Startup\

In the .bat prepend to all lines stating with subinacl
Eg.

subinacl /SUBDIRECTORIES "%ALLUSERSPROFILE%\Start Menu\Programs\SIMS Applications" /GRANT=%1=F

becomes

\\schoolname.county.sch.uk\SysVol\schoolname.county.sch.uk\Policies\{5BB037E4-9025-4685-A436-5D003B249635}\Machine\Scripts\Startup\subinacl /SUBDIRECTORIES "%ALLUSERSPROFILE%\Start Menu\Programs\SIMS Applications" /GRANT=%1=F

Or you could use:

Set simsgpopath=\\schoolname.county.sch.uk\SysVol\schoolname.county.sch.uk\Policies\{5BB037E4-9025-4685-A436-5D003B249635}\Machine\Scripts\Startup

which means you could do

%simsgpopath%\subinacl /FILE "%ALLUSERSPROFILE%\Start Menu\Programs\SIMS Applications" /GRANT=%1=F

save file
apply parameters to script in the form domain\security group



That should do it.