Grant User Group Permission on User Profile Folders using "icacls" script

[Guest]

Hi

 

im currently trying to save myself hours worth of work by adding permsions to user profile folders so that teachers can access the students work from a drive map.

I have 100+ Users i need to add a group permission to their "Desktop" "Documents" "Music" "Video" "Favorites" User folder

 

I have a txt document that currently reads the following

 

icacls "E:\Pupil Profiles\Users\User.V2\Desktop" /grant "Drive_PupilProfilesDrive":(OI)(CI)(M,DC)

icacls "E:\Pupil Profiles\Users\User.V2\Documents" /grant "Drive_PupilProfilesDrive":(OI)(CI)(M,DC)

icacls "E:\Pupil Profiles\Users\User.V2\Music" /grant "Drive_PupilProfilesDrive":(OI)(CI)(M,DC)

icacls "E:\Pupil Profiles\Users\User.V2\Pictures" /grant "Drive_PupilProfilesDrive":(OI)(CI)(M,DC)

icacls "E:\Pupil Profiles\Users\User.V2\Videos" /grant "Drive_PupilProfilesDrive":(OI)(CI)(M,DC)

Pause

 

im wanting to apply the group "Drive_PupilProfilesDrive" permissions to access the folders. i have tried the command prompt and works fine.

is there any way of adding *.V2 to the script so that it will apply to every student in the Users folder?

 

is that possible from this?

Edited February 22, 2015 by phillip_croxford

[halbaradkenafin]

It's possible, I can probably put something together using Powershell to get the folder names. But why not apply the permissions at the parent folder that holds all the pupil folders? If you're granting permissions to almost all the folders the pupils have anyway then it seems like the quickest and easiest option, plus there are usually pupils who don't save things in the documents folder despite being told to (unless they don't have permissions to save there).

[Guest]

I could put the permission at root level but i dont want the teachers group to have full controll of the pupil folder. its only specific folders within, as mentioned Documents, Music, videos etc..

 

if a powershell script could do it i wouldnt say no to that

[halbaradkenafin]

I could put the permission at root level but i dont want the teachers group to have full controll of the pupil folder. its only specific folders within, as mentioned Documents, Music, videos etc..

 

if a powershell script could do it i wouldnt say no to that

 

How much permission do they need? Write? Modify? Read? No need to give them full control if they only need to be able to view the pupil work.

[Guest]

modify permissions. if thats possible?

[halbaradkenafin]

modify permissions. if thats possible?

 

$Folders = Get-childItem -Path ""
$InheritanceFlag = [system.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [system.Security.AccessControl.InheritanceFlags]::ObjectInherit
$PropagationFlag = [system.Security.AccessControl.PropagationFlags]::None
$objType = [system.Security.AccessControl.AccessControlType]::Allow 


foreach ($TempFolder in $Folders)
{
Write-Output -InputObject "Loop Iteration"
$Folder = $TempFolder.FullName


$acl = Get-Acl -Path $Folder
Write-Output -InputObject "$TempFolder"
$permission = "\Drive_PupilProfilesDrive","Modify", $InheritanceFlag, $PropagationFlag, $objType
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission


$acl.SetAccessRule($accessRule)
if (Test-Path "$Folder\Desktop") { Set-Acl -Path "$Folder\Desktop" -AclObject $acl}
if (Test-Path "$Folder\Documents") { Set-Acl -Path "$Folder\Documents" -AclObject $acl}
if (Test-Path "$Folder\Music") {Set-Acl -Path "$Folder\Music" -AclObject $acl}
if (Test-Path "$Folder\Pictures") {Set-Acl -Path "$Folder\Pictures" -AclObject $acl}
if (Test-Path "$Folder\Videos") {Set-Acl -Path "$Folder\Videos" -AclObject $acl}
}

 

Should do it, you'll need to set the path to the root folder at the top and set the domain short name and group name in the $Permission variable. If you get any errors then paste then here and I'll have a look, shouldn't run into any problems as it checks if a folder exists before trying to set the permissions.

[Guest]

Thank you so much! will try that this afternoon and will feed back results!

[Guest]

im guessing i save the file as a .ps1 extension

[halbaradkenafin]

im guessing i save the file as a .ps1 extension

 

Yes or you can paste it into notepad, change the few things needed and then copy/paste it into a Powershell window and it should work.

[Guest]

It has worked like a charm! thank you so much. hours worth of work done in less than a minute!

[Guest]

can i ask. if i wanted to add the extra permission "Delete subfolders and files" what do i need to add to the script.

[halbaradkenafin]

can i ask. if i wanted to add the extra permission "Delete subfolders and files" what do i need to add to the script.

 

Modify should allow that and the permissions should force inheritance down each level, if not then I'll have a look into it.

 

Edit: Looks like the string you want is "DeleteSubdirectoriesAndFiles", just swap it with modify and it should add the permissions together I think. If not then you'll probably have to use "DeleteSubdirectoriesAndFiles, Modify" but I haven't tested that so it may be wrong.

Edited February 23, 2015 by halbaradkenafin

[Guest]

just tested the "DeleteSubdirectoriesAndFiles, Modify" and worked straight away! yet again. cant thank you enough.

this script will save me loads of time in the future!

 

again thank you

[halbaradkenafin]

just tested the "DeleteSubdirectoriesAndFiles, Modify" and worked straight away! yet again. cant thank you enough.

this script will save me loads of time in the future!

 

again thank you

 

No problem, we had a similar issue here and I had the majority of the script ready to go anyway.