Share Permissions

[wesleyw]

Is there a quick way to change the share permissions on a selection of shares in window 2003?

Wes

[ajbritton]

Did you by any chance forget to change them from their default values of Everyone: Read?? Thanks a lot Microsoft for that one.

1 - Get RMTSHARE

2 - Work out the command you need to change the share permissions
RMTSHARE \\server\sharename /GRANT Everyone:Full

3 - Build a text file which lists all the shares you want to modify (could use 'RMTSHARE \\servername > sharelist.txt')

4 - Manipulate the text file so that you have a series of rows resembling the command line given in step 2

5 - Save the text file as SHAREFIX.CMD

6 - Execute SHAREFIX.CMD by double clicking on it.

[Geoff]

As in the example command above I give everyone full access on share permissions and rely on NTFS permissions to lock down users access.

Mixing NTFS and Share permissions just leads to confusion. I have no idea why MS bothered with this redundant feature.

[ajbritton]

@Geoff: Maybe 'cos in the days before NTFS, share permissions were the only option? Also I suppose, share permissions are easier to manage if you don't need the more granular control afforded by file permissions. I know what you mean though. When I moved to NT from NetWare (good security/directory model but it crashed a lot!) I couldn't figure out why share and file permissions were required.

It would be good if Microsoft gave us the option of either disable share permissions, or defaulting new shares to a predefined value (maybe Admins: Full and Authenticated Users: Modify would have made more sense)

Here's a thought though. Any time a user creates a file, they automatically become the owner of it and can therefore modify the permissions. You may be able to prevent this behavour with the use of a specific Deny entry in the DACL, but presumably if the user is connected through a share which limits their permissions to Modify, they would not be able to change the permissions.

[wesleyw]

How did you guess? ops: lol

Wes

[acb_]

Heh, got caught like that on my home network last week. *&%$^ing piece of software re-ordered the share permissions on my server, so I reinstated the shares but forgot it would only be read. Took me far too long to work it out ops:

[ajbritton]

How did you guess? ops: lol

Wes

Been there, done it, got T-shirt etc.