Help using icacls

[lholland421]

Hi all, This is probably really easy so you will have to excuse me ! Nearly half term !

 

i have a folder stucture like this : \\server\users\yeargroup\USERNAME

 

I need to apply permissions to all of the folders under \\server\users\yeargroup\

 

I have used this command on one users folder which has done what i want but now i need to apply it to every users folder.

 

icacls "D:\users\yeargroup\USERNAME" /grant itstaff:F

 

Any ideas ?

 

Cheers

[halbaradkenafin]

I came up with a script for this in Powershell a while back. I want to update it with some stuff from the NTFS Security module that was released after I created it but it works fine for this scenario.

 

$Folders = Get-childItem -Path ""
$InheritanceFlag = [system.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [system.Security.AccessControl.InheritanceFlags]::ObjectInherit
$PropagationFlag = [system.Security.AccessControl.PropagationFlags]::None
$objType = [system.Security.AccessControl.AccessControlType]::Allow 


foreach ($TempFolder in $Folders)
{
Write-Output -InputObject "Loop Iteration"
$Folder = $TempFolder.FullName
$UserFolder = $TempFolder


$acl = Get-Acl -Path $Folder
Write-Output -InputObject "\$UserFolder"
$permission = "\$UserFolder","FullControl", $InheritanceFlag, $PropagationFlag, $objType
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission


$acl.SetAccessRule($accessRule)
Set-Acl -Path $Folder -AclObject $acl
}

 

Drop it into a ps1 file on your file server, I'd suggest running it from a powershell prompt rather than just right clicking it (or from the Powershell ISE) and that way you'll see any errors (hopefully there aren't any).

[Michael]

Another method, click Ctrl+A to select all, then hold shift and right click the selection.

 

Select 'Copy as path' then paste into notepad or excel for example and add the rest of the icalcs commands.

[DellOughta]

As Michael says, you should be looking to create a .txt file looking something like this with all your users listed, then copy it all into a cmd prompt and run

 

iCACLS F:\Students\yearof09\cowansrb01 /grant:r DOMAIN\bloggsf01:(OI)(CI)F /T /C

[johnfermor]

Would my "Reset NTFS User Folder Permissions" script be of any use?

 

Reset NTFS User Folder Permissions | johnfermor.co.uk

 

Save the script to the server desktop, modify the permissions (in the script) as required, then drag & drop your user folders on it!

 

John

Edited February 15, 2015 by johnfermor

[lholland421]

Just tried using the above tool and i get an error processing the folder. Any other tools i could use. The home directory permissions are a complete mess. I cant get into some user areas without giving admins permissions first ! They are all set not to inherit permissions too. Could someone give me a tool to correct this and what are the correct settings that should be setup on the user share and directories.

 

Thanks

[johnfermor]

Just tried using the above tool and i get an error processing the folder. Any other tools i could use. The home directory permissions are a complete mess. I cant get into some user areas without giving admins permissions first ! They are all set not to inherit permissions too. Could someone give me a tool to correct this and what are the correct settings that should be setup on the user share and directories.

 

Thanks

 

I've used the script a number of times so it should be fine. It sounds like you'll need to "Take Ownership" of all of the folders first. As with any script of this type, you will need admin rights to run it.

 

You have changed the permissions to match that of your own? You need to change this section:

 

' Set the DEFAULT Permissions of the Object Folder

' ------------------------------------------------

dim strPerms

strPerms = chr(34) & "Administrators" & chr(34) & ":F "

strPerms = strPerms & chr(34) & "Teachers" & chr(34) & ":R "

 

%USERNAME% is given "change" rights elsewhere in the script, but you need to ensure that you include *your* security groups with the right syntax. In the above example, Administrators get "Full" and "Teachers" get "ReadOnly" access - if these specific groups don't exist on your system, the script will fail.

 

While testing, you may also want to delete the last line above so that ONLY %USERNAME% and Administrators are given appropriate rights. Then you can try adding other groups as required.

 

Also, this line should produce an error and code; what are they? This should indicate the point of failure.

 

if retval > 0 then msgbox "Error setting permissions: " & objFolder.path, 0, "Error " & retVal

 

If you're having trouble with the syntax, perhaps you could post your user groups (and required permissions) and I'll try to help with this.

 

John

Edited February 17, 2015 by johnfermor

[jklight]

probably can do with dos for command like this:

for /D %a in (\\server\users\yeargroup\) do icacls %a /grant itstaff:F

 

I have used the script that follows in the past to fix problems. It querys AD first to select users you need fixing and the does the ICACLS work on their homedirectory taken from AD.

REM reset users permissions
REM @[u][url="http://www.edugeek.net/member.php?u=16971"]echo[/url][/u] off
if {%1}=={} @[u][url="http://www.edugeek.net/member.php?u=16971"]echo[/url][/u] syntax: %0 Description&goto :EOF


dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User)(description=%~1)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(homedirectory=*FILE-SERVER*))" -limit 500 | dsget user -hmdir -samid -c > out.txt
for /f "skip=1 tokens=1,2" %%a in (out.txt) do call :resetp %%a %%b 
goto :EOF


:resetp
if /I %1 EQU dsget goto :EOF
TAKEOWN /F %2 /R /D Y > NUL
icacls %2 /reset /Q /T /C >>log.txt
icacls %2 /setowner %1 /Q /T /C >>log.txt
icacls %2 /grant:r administrators:(OI)(CI)(F) system:(OI)(CI)(F) %1:(F) "creator owner":(OI)(CI)(IO)(F) /Q /C >>log.txt

Edited February 17, 2015 by jklight
Code tag