Shared folder permissions issue.

[Jamesy_uk]

Aloha,

 

I committed a bit of a sin when I found myself having to build a whole new network infrastructure setup during the last summer holiday when we had an unamicable split with our support company. I copied the file structures for old student data straight off the old server onto the new one making a new hidden share folder and setup folder redirections to match the structure.

This worked fine however, we are now in a live environment and an enterprising young man has found a way to access the root of the hidden share and as such can see and access all of the folders under that root. I have no idea how he has managed this so far he doesn't have any kind of admin logon as he created a couple of rudely named folders and his account was named as owner, network browsing etc isn't allowed via group policy and I can't work it out I have tried everything I can think of.

 

So back to the problem at hand I need to modify the main share folder structure permissions while keeping all the users accessing their folders as usual but stop this kid (and anyone he tells how he managed it) from browsing the root folder and accessing their work. As a side bonus actually work out how he managed to access the root in the first place as he isn't talking.

 

Currently the structure is \\servername\studentdata$\ (followed by %username%)

Currently the folder has:

 

System - full control

Administrators - full control

Domain users - full control

My user - full control

 

Foolishly I assumed as I had prevented network browsing and hard coded the folder redirection I was o.k but this obviously isn't the case as he is somehow accessing the root.

I am a bit lost on how to secure this now without manually permissioning every folder to it's users as normally when the system creates the directories they are set up for creator etc whereas in this case I copy and pasted all 1300 user folders and 400gb of data over.

 

 

Regards

 

James.

[Davit2005]

Did you give Domain Users Full Control??

 

Our student share root folder has Creator Owner, System, IS Services, backupAccount has full control on Subfolders and files only.

[Jamesy_uk]

Yes Davit,

 

It was one of the many things I had to quickly bodge through as I had less than 2 weeks to build a totally new network server setup and domain 650 machines before they took our old server hardware away. Not my finest moment but I was sweating bullets and on my own at the time. My problem was the lock, stock folder structure for students data was copied from one server (2003) to another (2008r2) so the old file permissions were wiped and It just inherited to get them up and going asap. Now I need to lock this share root down without affecting users access and I am probably being too paranoid about adjusting anything because I don't fancy manually fixing 1300 users permissions one by one if I do get it wrong lol.

[LiamH]

Not much help now, but if you use xcopy you can copy files and folders with permissions.

 

We had an issue where a colleague reset the permissions on pupil data, had to write a script that gave permissions to the username (taken from the folder name) i will see if i can find it.

[Joanne]

You would want:

 

Share

student accounts - traverse folder

administrators - full control

staff accounts - ?

Make sure that these are THIS FOLDER ONLY.

 

Definitely take that domain users off there. That means all the kids can see all the folders!

[Jamesy_uk]

Thanks Liam,

 

Problem with xcopy was it was a new DC, new everything, so even if I had I don't think the security identifiers would have married up on the new system even if the student id's were created the same, I might be wrong on that.

I have been chasing my tail on some snap decisions I made during that dark time in September that's for sure, in hindsight I should have just told the bosses what they expected wasn't possible on that timescale and took my lumps.

[halbaradkenafin]

I've got a powershell script to handle this, just need to change the root directory to whatever it will be and add the domain short name to the $Permissions variable. I'd also remove Domain Users from the parent folder permissions before running this.

 

$Folders = Get-childItem -Path ""
$InheritanceFlag = [system.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [system.Security.AccessControl.InheritanceFlags]::ObjectInherit
$PropagationFlag = [system.Security.AccessControl.PropagationFlags]::None
$objType = [system.Security.AccessControl.AccessControlType]::Allow 


foreach ($TempFolder in $Folders)
{
Write-Output -InputObject "Loop Iteration"
$Folder = $TempFolder.FullName
$UserFolder = $TempFolder


$acl = Get-Acl -Path $Folder
$permission = "\$UserFolder","Modify", $InheritanceFlag, $PropagationFlag, $objType
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission


$acl.SetAccessRule($accessRule)
Set-Acl -Path $Folder -AclObject $acl
}

 

As for how they did it I suspect it's caused by Domain Users having full control and them possibly being able to see the root path in My Computer (either next to the drive icon or once navigating their drive). I'm not 100% on that though so it might not be exactly how they did it.

[Jamesy_uk]

Joanne,

 

I understand on the domain users part, just thought I had been clever enough to hide all the access points to that area!, guess not eh well it last 4 months heh. The kid in question fancies himself a bit of a hacker he tries running proxy programs, tor browsers... you name it lol. Teachers just find it funny and don't even sanction him.

[Joanne]

Suppose he is being 'creative'. The traverse folder will enable pupils access, but not into the folder itself. I *think* that you can reset all permissions on folders by going into AD, selecting all the kids in a folder and reassigning their home drives (\\server\share\intake\%username%) I'm pretty sure that will fix permissions on folders if they already exist... but don't take my word for it... (dat confidence).

[Davit2005]

Yes Davit,

 

It was one of the many things I had to quickly bodge through as I had less than 2 weeks to build a totally new network server setup and domain 650 machines before they took our old server hardware away. Not my finest moment but I was sweating bullets and on my own at the time. My problem was the lock, stock folder structure for students data was copied from one server (2003) to another (2008r2) so the old file permissions were wiped and It just inherited to get them up and going asap. Now I need to lock this share root down without affecting users access and I am probably being too paranoid about adjusting anything because I don't fancy manually fixing 1300 users permissions one by one if I do get it wrong lol.

 

Not a problem. I just wanted to know if that had changed some how.

 

We live and learn :-) . For instance I always use the Advanced Sharing function since I found it allows for greater granularity than the 2008/2012 standard Sharing facility that changes security permissions as well

Edited February 24, 2015 by Davit2005

[LiamH]

Set FSO = CreateObject("Scripting.FileSystemObject")
Set ObjShell = Wscript.CreateObject("Wscript.Shell")

ShowSubfolders FSO.GetFolder("D:\userdrives")

Sub ShowSubFolders(Folder)
   For Each Subfolder in Folder.SubFolders
       WScript.Echo "Folder = " & Subfolder
userName = SubFolder.Name

CMDLine0 = "icacls """ & Subfolder & """ /setowner %domain%\" & userName & " /t"
WScript.Echo "Setting the owner of " & Subfolder
ObjShell.Run CMDLine0


CMDLine1 = "icacls """ & Subfolder & """ /grant %domain%\" & username & ":(OI)(CI)M"
WScript.Echo "Setting object and folder inheritance on the directory and applying modify permissions for the owner"
ObjShell.Run CMDLine1

   Next
End Sub

 

Might want to run a trial run before using it on the user drives been a while since i used it.

 

You will need to change the D:\userdrives to wherever they are located on the server. To test it just make a folder with subfolders that are valid usernames and try it.