Help! Accidently deleted permissions on our home folders!

[ben604]

Typical, first day back from half term and I manage to spoon up my home folders...

 

I added a group to map the student home folders for the teachers and when I returned, all permissions had disappeared on all the student home folders...

 

Is there a quick fix for this? There's a share "Student$" and their folders are named after their usernames, eg 11jonesb.

 

I'm sure this question has been asked thousands of times(!!) on this forum, but, looking at the time, I could do with getting this fixed pretty quickly!!

 

Any help would be greatly appreciated.

[mrbios]

So in other words you've forced all the folders that allowed individual students access to their own folders to inherit the permissions of the folder above? Is that correct?

 

EG: \\server\homeshare\studentfolder1 through to student folder 200 or something, where you changed the settings of "homeshare" so that "studentfolder1-200" all have the same permissions?

 

If that's the case i can help you

[ben604]

Yeah, I think so. There were no permissions initially, I've had to take ownership again...I've since added us admins with full control and the teacher group with read access. Just need to reinstate the kids permissions on each individual folder now...only 700 of them...

[mrbios]

Ok, pm me your email and i'll send you a folder containing: setacl.exe, an example batch file and a spreadsheet that you can edit (i'll explain what you need to edit) then you can take the concatenated column of the spreadsheet into a batch file to create the permissions for each folder again....it's not exactly quick but it works and might save you some time

 

EDIT: if it works out well for you in this instance i might edit it and make a proper help sheet so others can use it. There might be easier ways than this but this was the easiest way that i could find.

Edited April 8, 2013 by mrbios

[mrbios]

Instructions sent, a bit messy but hopefully having left the spreadsheet full of the information i used previously it'll make more sense.

 

Oh and ignore my junk about the desktop.ini thing...i don't think that bit actually ever worked haha

[FN-GM]

Have a search on here there is a script for this

[naysweb]

We use this all the time.

 

http://www.wisesoft.co.uk/software/ntfsfix/default.aspx

 

Might help.

[strawberry]

Ntfsfix s is the puppy for this one. Use the %username% variable

[mrbios]

We use this all the time.

 

NTFSFix

 

Might help.

 

How have i not seen this before?! This is awesome!!!

 

nice to know the script method i must admit but man that program looks to make it so much easier!

[old_n07]

This script will get the folder contents (directories only) in the share and assuming the folder name is the student's SAM name will add the student with modify permissions to the folder

 

**This is untested as I'm at home with no access to AD**

 

$InitialFolder = "\\server\share$\" #edit to reflect your path but needs trailing \

$Files = Get-ChildItem $InitialFolder -Directory #get content of share

foreach ($file in $files) {

$student = $file.name
$path = $InitialFolder + $student

icacls $path /grant "$student:`(OI`)`(CI`)M"

}

 

HTH

[naysweb]

How have i not seen this before?! This is awesome!!!

 

nice to know the script method i must admit but man that program looks to make it so much easier!

 

We run it every so often, for peace of mind.

[ben604]

Thanks for your help guys! I used mrbios' setacls method to get me most of the way there, just didn't propagate the permissions down to the child files/folders...might use that ntfxfix to finish the job.

[mrbios]

Thanks for your help guys! I used mrbios' setacls method to get me most of the way there, just didn't propagate the permissions down to the child files/folders...might use that ntfxfix to finish the job.

 

Ah that's odd, maybe I've missed a bit off as it should have done (unless it's something to do with the ownership that's causing that problem, as you did mention it not working until you set domain admins in the last column?)

[jklight]

I have been trying to do more in powershell but I still like cmd shell when it is quick and clean like:

for /D %a in (\\server\share\*) do icacls "%a" /grant %~na:(OI)(CI)M

The tricky part is the %~na but it just gets the name part of the path. for /? will get you more options/descriptions

Edited April 9, 2013 by jklight

[EduTech]

I have used NTFSFix in the past on many occasions to get people who have done this out of the cr:p :-) Great tool to keep in your back pocket! :-)

 

James.

[ben604]

Right, I'm 99% there... students have access to their folders and all the right permissions are in place, apart from their subfolders and files. I've tried NTFSFix, but that isn't fixing the subfolders/files either.

 

Is there a batch I can run to literally tick this button for each folder?

 

 

(I've already done it on this folder, hence the "apply to" bit showing this folder, subfolders...etc)

Edited April 10, 2013 by ben604

[mrbios]

If it's not working with either program then i suspect that's probably an ownership issue...if you force a change of ownership on the root folder to give the fileserver administrator ownership and tick the box to change all subcontainers and contents then tried running it again that might fix it (though it might also wipe the permissions you've just set, requring you to set them again) best off running that on the fileserver directly too as there's sometimes issues with doing it via a share or unc path.

[ben604]

If it's not working with either program then i suspect that's probably an ownership issue...if you force a change of ownership on the root folder to give the fileserver administrator ownership and tick the box to change all subcontainers and contents then tried running it again that might fix it (though it might also wipe the permissions you've just set, requring you to set them again) best off running that on the fileserver directly too as there's sometimes issues with doing it via a share or unc path.

 

Hey mrbios,

 

That was exactly the problem. I've just run your script again this morning, after taking ownership overnight with a batch, and it's working for all folders and subfolders.

 

Schoolboy error. Going to take another 5 hours to re-run the NTFS permission scripts again now...d'oh!

 

Thanks for your help!

[mrbios]

No problems, good to hear you've got it solved

[chazzy2501]

couldn't you have batch selected your users in AD and re point their home folder \\server\share\%username%\ and have it set the correct permissions again?

 

just a thought, untested...

[ben604]

Fixed. Rejoice in the highest!