Scanning For Permission Changes

[Gongalong]

Hi folks,

 

This is technically on a 2008 R2 server, but is more of a general Windows question.

 

I've got some students that are changing the permissions on their folders (taking ownership, and removing the administrator and all other accounts bar theirs). I don't know why they are getting full control on their folders, unless this is just standard Windows behaviour when creating a home folder.

 

The problem is that I only discover this when I click on the particular home folder, and with some students it's a subfolder within.

 

Is there a way to check/scan/whatever a number of folders to see if the administrator has been locked out?

 

TIA

[detjo]

You've checked the permissions on their folders to ensure they dont have full control?

And the root folders, as it might be inherited etc ?

 

AccessChk at SysInternals might be of some use

Edited November 8, 2013 by detjo

[Gongalong]

Well all students have full control of their own folders - as mentioned above I don't know whether Windows did this when building their home folder, or whether it's something our user import tool does (Ranger Account Manager). Either way it's what we have now.

 

For the students that have done it I've removed full control, on the assumption that's what they've used (versus Modify) to make this change.

 

I'll have a look at AccessChk.

 

Another mechanism I might be able to use is TreeSize, which presumably won't be able to scan folders with only the user's permissions. I can at least then quickly look through a list of folders to see what is zero bytes or can't be checked.