Mass setting NTFS permissions

[localzuk]

I wasn't sure whether I should post this a seperate topic or not but I did in the end.

I now have my server set up how I want. I have ~600 pupil folders which all have permissions set correctly except for the actual user/owner of the folder.

The folders are named the same as the username.

I am wondering if there is a quick way of changing the permissions on all the folders without having to go through each directory and add the user as a permitted user with their associated priviliges?

Otherwise, I shall be here for a while editing each folder.

Cheers
Tony

[apeo]

I think this has been covered before but my internet is playing up so i cant really search on the forum for it. Anyway you can use a script to set the permissions using cacls and/or xcacls.

[OutToLunch]

If you're happy enough on the command line, it should be a 2 minute job using CACLS and a FOR loop.

for /D %I in (*) do cacls blah

from a command prompt in the folder holding your pupil folders. The syntax for the cacls blah part will depend on exactly what you want to set...

http://www.microsoft.com/resources/d...-us/cacls.mspx

HTH

[localzuk]

Ah, I've done it using c# now. Cheers anyway. Would anyone like me to post the code I used?

[ajbritton]

Very much so!

[localzuk]

Ok. Well here it is:

            string user = "";

            string path = "";

            DirectoryInfo[] dirs = new DirectoryInfo(".").GetDirectories();

            foreach(DirectoryInfo di in dirs){

                path = di.FullName;

                user = di.Name;

                try

                {

                    DirectorySecurity dirSec = Directory.GetAccessControl(path);

                    dirSec.AddAccessRule(new FileSystemAccessRule(@"sch4290\" + user, FileSystemRights.FullControl, AccessControlType.Allow));

                    Directory.SetAccessControl(path, dirSec);

                    System.Console.WriteLine("DIR: " + user + " permissions added");

                } catch(Exception e){

                    System.Console.WriteLine("Error: " + e.Message);

                }

            }

You need to use System.IO and System.Security.AccessControl for it to work.

To prepare for this, I reset all permissions on the folders so that the groups that could access them were set up before these were set. I might tidy it up at some point and make it a little neater.

It did the job though.

[localzuk]

Actually, it seems to have given the permissions to the top level but none of the files/folders within. I'll make a few changes and post the result here.

[localzuk]

Right, found the thing I needed to change.

From this

dirSec.AddAccessRule(new FileSystemAccessRule(@"sch4290\" + user, FileSystemRights.FullControl, AccessControlType.Allow));

to this

dirSec.AddAccessRule(new FileSystemAccessRule(@"sch4290\" + user, FileSystemRights.FullControl, InheritanceFlags.ObjectInherit | InheritanceFlags.ContainerInherit, PropagationFlags.InheritOnly, AccessControlType.Allow));

And now it gives the right permissions to all child leaf objects and container objects.

Oh, and remember - the share also has to have write permissions for the group which the users reside else all the files will come up as read only.