[ms office - 2010] Students accessing other students files using Manage Templates

[thatuser]

They are using the insert chart tool.

[ATTACH=CONFIG]23536[/ATTACH]

And then clicking manage templates,

[ATTACH=CONFIG]23537[/ATTACH]

and then because their appdata, is stored with their documents they can access all other students document.

 

Don't know if anyone else has this problem. thanks guysss

[forkies]

Surely the documents are held on the server and only the student themselves has access to their own folder only?

 

If you have students permissions to everyones docs this is what I had at my old school, I wrote a script to reset the permissions on the folders, I posted a while back on some forum I am sure I can dig out that will grab the name of the folder (guessing this is the username for the users documents) and rewrite the permissions to give them access and domain admins. All you then have to do is remove the students access from the root.

 

Let me know if you want it and I will dig it out.

[thatuser]

Please, that would help a lot,

 

Thanks

[3s-gtech]

Try the NTFSFix utility, it's free (and immense). You can set permissions for each folder in a directory by %username% in AD. Job done.

[forkies]

Sorry for the long delay. Attached is the script (had to dig it out). It just runs through the folder ie "Q:\Users\Year7" then takes each folder name queries against AD if username doesnt exist it takes ownership as administrators then dumps the folder in the deleted user folder (see inside script).

It gives access to two AD groups studentdocsread and studentdocsmodify which we use for IT teaching staff who need access to the students docs. It then shares (even if already shared as it was a quick and dirty script) as username$ with relevant permissions.

 

I have a ps1 script that calls each year folder up like so:

.\UserHomesCheckStudent2.ps1 -year 13
.\UserHomesCheckStudent2.ps1 -year 12
.\UserHomesCheckStudent2.ps1 -year 11
.\UserHomesCheckStudent2.ps1 -year 10
.\UserHomesCheckStudent2.ps1 -year 9
.\UserHomesCheckStudent2.ps1 -year 8
.\UserHomesCheckStudent2.ps1 -year 7

 

 

Full script below:

 

param(
[string]$year
)
#Prerequisites
#Share permissions: [url=http://en-us.sysadmins.lv/Lists/Posts/Post.aspx?List=332991f0-bfed-4143-9eea-f521167d287c&ID=28]Share management in PowerShell - PowerShell Crypto Guy's weblog[/url]
#Subinacl: [url=http://www.microsoft.com/en-gb/download/details.aspx?id=23510]Download SubInACL (SubInACL.exe) from Official Microsoft Download Centre[/url]
#Quest: [url=http://www.quest.com/powershell/activeroles-server.aspx]PowerShell Commands (CMDLETs) for Active Directory by Quest[/url]

#Configure your settings here
#Set Domain
$domain = "domain.local"
#Set admin group
$admin = "Domain Admins"
#Set group to modify students docs
$modify = "StudentDocumentsModify"
#Set group to read student docs
$read = "StudentDocumentsRead"
#Set the folder to work on here
$homesroot = "Q:\Users\Student\Year$year"
#Set the deleted homes folder
$dhomesroot = "Q:\DeletedUsers\"
#Where is subinacl
$subinacl = "C:\utils\subinacl.exe"
#Where to log to
$LogFileDir = "Q:\Log"
#Finished config

Write-Host "Cox Green School User Home Folder Check Script"
Write-Host "Written by Tom Smith"
Write-Host "Version 1.1"
Write-Host "Date: 11/05/2013"
Write-Host "Editing Home Directories within $homesroot"
Write-Host "Deleted user homes will go to $dhomesroot"

#Load Quest even if installed
Add-PSSnapin Quest.ActiveRoles.ADManagement
#Load PSCX
Import-Module "PSCX"
Set-Privilege (New-Object Pscx.Interop.TokenPrivilege "SeRestorePrivilege", $true)#Necessary to set Owner Permissions
Set-Privilege (New-Object Pscx.Interop.TokenPrivilege "SeBackupPrivilege", $true)#Necessary to bypass Traverse Checking
Set-Privilege (New-Object Pscx.Interop.TokenPrivilege "SeTakeOwnershipPrivilege", $true)#Necessary to override FilePermissions & take Ownership
#Load ShareUtils
Import-Module ShareUtils
#Create folder in deleted users with todays date
$date = Get-Date -format "dd-MM-yyyy"
$dDay = Get-Date -format "dd"
$dMonth = Get-Date -format "MM"
$dYear = Get-Date -format "yyyy"
$dFolder = "$dhomesroot" + "$dYear" + "\" + "$dMonth" + "\" + "$dDay"
New-Item $dFolder -type directory -Force
Write-Host "Todays Date is $date"
$dirlist = gci $homesroot -Exclude *.* | ? { $_.PSIsContainer }

$LogFile = "$LogFileDir\$date.log"
function Log {
   param ([string]$msg, [int]$flag)
$time = Get-Date -Format "HH:mm"
   if ($flag -eq 0) {
       Write-Output "$date INFO: $msg" | Out-File $LogFile -append
   } elseif ($flag -eq 1) {
       Write-Output "$date WARNING: $msg" | Out-File $LogFile -append
   } elseif ($flag -eq 2) {
       Write-Output "$date ERROR: $msg" | Out-File $LogFile -append
   } elseif ($flag -eq 3) {
       Write-Output "$msg" | Out-File $LogFile -append
   }
} 

Log "" 3
Log "Script start date: $date" 3
Log "Script start time: $time" 3
Log "Script currently working on Year$year" 3
Log "" 3
foreach ($userdir in $dirlist)
       {
           $username = $userdir.name
           Write-Host "Working on user folder $username"
		Log "Working on user folder $username"
           $adaccount = Get-QADUser $username
           #Verifies user is an active account, renamed folder to be deleted if not
           If (($adaccount.AccountIsDisabled -eq $TRUE) -or (!$adaccount))
               {
                   write-host "$username is not a current user in active directory"
				Log "The user $userame was not found in active directory" 1
                   #takeownership to administrators
                   takeown /f $userdir /R /D Y /A >> $LogFileDir\log.txt
				Remove-Item "$LogFileDir\log.txt"
                   #rename folder to _DEL_originalname
                   $newname = "_DEL_$username"
                   rename-item -path $userdir -newname $newname
                   #Move deleted user folders to deleted user homes path
                   $oldpath = "$homesroot" + "\" + "$newname" + "\"
                   $newpath = "$dFolder" + "\" + "$newname"
                   move-item $oldpath $dFolder
                   Write-Host "User folder $username was moved to $dFolder "
				Log "User folder $username was moved to $dFolder, the original was from Year $year" 0
               }
           Else
               {
               #get full path            
               Write-Host $userdir.name
               Write-Host "$username is valid in active directory"
			Log "User $username is valid in active directory" 0
               $currentDir = $userdir.FullName
               #Take ownership for admins for setting permissions
               takeown /f $userdir /R /D Y /A >> $LogFileDir\log.txt
			Remove-Item "$LogFileDir\log.txt"

               #get ACL of folder and set inheritance to allow parent
               $acl = Get-Acl $currentDir
			$acl.SetAccessRuleProtection($false, $true)
			Set-Acl $currentDir -AclObject $acl

               #get ACL of folder
               $acl = Get-Acl $currentDir

               #variable to set new permissions for username of folder
               Write-Host "$domain\$username"
               $permission = "$domain\$username",”FullControl”,”ContainerInherit,ObjectInherit”,”None”,”Allow”
               $permission1 = "$domain\$admin",”FullControl”,”ContainerInherit,ObjectInherit”,”None”,”Allow”
			$permission2 = "$domain\$modify",”Modify”,”ContainerInherit,ObjectInherit”,”None”,”Allow”
			$permission3 = "$domain\$read",”Read”,”ContainerInherit,ObjectInherit”,”None”,”Allow”

               $accessRule = new-object System.Security.AccessControl.FileSystemAccessRule $permission
               $accessRule1 = new-object System.Security.AccessControl.FileSystemAccessRule $permission1
			$accessRule2 = new-object System.Security.AccessControl.FileSystemAccessRule $permission2
			$accessRule3 = new-object System.Security.AccessControl.FileSystemAccessRule $permission3

               #actually set the permissions
               $acl.SetAccessRule($accessRule)
               $acl.SetAccessRule($accessRule1)
			$acl.SetAccessRule($accessRule2)
			$acl.SetAccessRule($accessRule3)
               Set-Acl $currentDir $acl

               $acl3 = Get-Acl $currentDir
               $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ("Everyone","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
               $acl3.RemoveAccessRuleAll($rule)
               $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($admin,"FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
               $acl3.AddAccessRule($rule)
               $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($username,"FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")
               $acl3.AddAccessRule($rule)
			$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($modify,"Modify", "ContainerInherit, ObjectInherit", "None", "Allow")
               $acl3.AddAccessRule($rule)
			$rule = New-Object System.Security.AccessControl.FileSystemAccessRule($read,"Read", "ContainerInherit, ObjectInherit", "None", "Allow")
               $acl3.AddAccessRule($rule)
			
			#Set Owner
               $domuser = "$domain\$username"
               $accnt = New-Object System.Security.Principal.NTAccount($domuser)
			$acl.SetOwner($accnt)
               Set-Acl $currentDir $acl
			dir -r $currentdir | Set-Acl -AclObject $acl
			
			#Set up share
			$shareperm = "/GRANT:" + $username + ",FULL"
			function New-Share {
			param($Path, $Name)
			try {
			$ErrorActionPreference = 'Stop'
			if ( (Test-Path $Path) -eq $false) {
			$null = New-Item -Path $Path -ItemType Directory
			}
			net share $Name=$Path $shareperm
			}
			catch {
			Write-Warning "Create a new share: Failed, $_"
			}
			}
			New-Share $currentDir $username$
			#Set share permissions for admin keeping old permissions
			Get-Share -Name $username$ | Add-SharePermission $admin Allow FullControl | Set-Share
			Get-Share -Name $username$ | Add-SharePermission $modify Allow Change | Set-Share
			Get-Share -Name $username$ | Add-SharePermission $read Allow Read | Set-Share
			Write-Host "Share script end"
			Log "Folder $username was shared" 0
               #Any further scripts here
               }
       }
Write-Host "Script complete todays date is $date "
Log "Script completed Year$year" 3
Log "Script end date: $date" 3
Log "Script end time: $time" 3