Home Area Permissions

[DSapseid]

I was just looking through all the permissions for the student home areas and all i can say is that its a mess! Can i write a batch file to clear what is currently there and then add what i want.

 

I want Administrators, Student Home Area Viewers, Username to all have Full control and thats it.

 

This works fine on this years year 7 accounts as the folders were created by the software that i used to create the accounts. Not that i can remember what it was called!!

[OutToLunch]

2 minute job with CACLS or your tool of choice... If you're happy with batch scripting it's just a for /D %%I in (*) do jobby

[ChrisH]

I find subinacl better these days incase you run into permission problems actually changing the folders details. I posted an example script recently.

[DSapseid]

whats the username element in calcs is it %USERNAME% or or something else?

[ChrisH]

If you are using a loop such as for /D %%I in (*)

 

Then you get he username from the folder name.

[DSapseid]

Ive got this so far how do i put your code together with mine?

 

cacls d:\Data\Home\Intake02\* /e /t /g "%USERNAME%":f

[ChrisH]

Assuming you are running from the root directory of the folders you want to change

 

for /D %%i in (*) do (
  cacls %%i /T /E /G yourdomain\domain admins:F 
  cacls %%i /T /E /G yourdomain\%%i:c
  cacls %%i /T /E /G fishermore\AreaViewers:c
)

 

The subinacl equivalent which would sort ownership as well and is less likely to run into problems is :

 

for /D %%i in (*) do ( subinacl /file %%i /grant=yourdomain\%%i=C "/grant=yourdomain\domain admins=f" /grant=yourdomain\AreaViewer=c /setowner=yourdomain\%%i 

subinacl /subdirectories %%i\* /grant=yourdomain\%%i=f "/grant=yourdomain\domain admins=f" /grant=yourdomain\AreaViewer=r /setowner=yourdomain\%%i  ) 

 

%%i is where the username is stored that it gets from the folder name.

[projector1]

Assuming you are running from the root directory of the folders you want to change

 

for /D %%i in (*) do (
  cacls %%i /T /E /G yourdomain\domain admins:F 
  cacls %%i /T /E /G yourdomain\%%i:c
  cacls %%i /T /E /G fishermore\AreaViewers:c
)

 

The subinacl equivalent which would sort ownership as well and is less likely to run into problems is :

 

for /D %%i in (*) do ( subinacl /file %%i /grant=yourdomain\%%i=C "/grant=yourdomain\domain admins=f" /grant=yourdomain\AreaViewer=c /setowner=yourdomain\%%i 

subinacl /subdirectories %%i\* /grant=yourdomain\%%i=f "/grant=yourdomain\domain admins=f" /grant=yourdomain\AreaViewer=r /setowner=yourdomain\%%i  ) 

 

%%i is where the username is stored that it gets from the folder name.

 

 

just used this

 

for /D %%i in (*) do ( subinacl /file %%i /grant=yourdomain\%%i=C "/grant=yourdomain\domain admins=f" /grant=yourdomain\AreaViewer=c /setowner=yourdomain\%%i

 

ChrisH your a legend, saved me hours of work! Thanks mate!

:cool:ChrisH:cool:ChrisH:cool:ChrisH:cool:

[amfony]

i did this differently but achived the same result by:

 

1) going into the root directory (depending on your folder structure, mine are year seperated)

2) do a dir /b >> namesOfStudents.txt

3) for /f %x in (namesOfStudent.txt) DO cacls /e /t /G %[email protected]:C

 

This ofcourse only works if the home folders are the same as the username.

[deansmith123456]

just used this

 

for /D %%i in (*) do ( subinacl /file %%i /grant=yourdomain\%%i=C "/grant=yourdomain\domain admins=f" /grant=yourdomain\AreaViewer=c /setowner=yourdomain\%%i

 

ChrisH your a legend, saved me hours of work! Thanks mate!

:cool:ChrisH:cool:ChrisH:cool:ChrisH:cool:

 

every time i try this it says %%! is unexpected at this time - any ideas??

[nitinkrjain]

Assuming you are running from the root directory of the folders you want to change

 

for /D %%i in (*) do (
  cacls %%i /T /E /G yourdomain\domain admins:F 
  cacls %%i /T /E /G yourdomain\%%i:c
  cacls %%i /T /E /G fishermore\AreaViewers:c
)

 

The subinacl equivalent which would sort ownership as well and is less likely to run into problems is :

 

for /D %%i in (*) do ( subinacl /file %%i /grant=yourdomain\%%i=C "/grant=yourdomain\domain admins=f" /grant=yourdomain\AreaViewer=c /setowner=yourdomain\%%i 

subinacl /subdirectories %%i\* /grant=yourdomain\%%i=f "/grant=yourdomain\domain admins=f" /grant=yourdomain\AreaViewer=r /setowner=yourdomain\%%i  ) 

 

%%i is where the username is stored that it gets from the folder name.

 

 

 

Seems interesting, will it work on windows server 2008 SP1.

[bono]

Hi Guys,

I am having the same problem. I want to give users Full Controll to their own home directory folders. The rest of the permisions on the folders are correct and I would like to amend them by giving each users Full control to his/her own folder only. I have tried CAClS but it freezes while Subinacl I can not get it to work. Obviously I am not doing it correctly so I was hoping if someone would be able to help.

I am using Server 2008, I have 1600 home directories in the same location "D\Users\Students\..Home directory share the same name as Student acounts. Any help would be greatly apreciated

[ADMaster]

I have not tried these scripts yet, but last time I needed to fix permissions on home directory's I used wisesofts ntfsfix utility

 

NTFSFix

[bono]

Hi Dana,

Thanks for your reply. I have tried NTFSFix but it does freeze the explorer everytime it runs.

[ADMaster]

I don't try to do 1600 at once all my students are in folders by year, so i do one year at a time. Since you have so many in one folder I would try asking your script to do a part of them at once.

 

A-F G-L etc, I don't know about batch, but in Powershell I can do -like a* -or -like b*

 

Give it a try and let us know how it works.

[ianchard]

I do this by logon script under the students OU. Works fine for correcting students as they logon, but not so great for correcting any historic data you may have.

 

The script runs once to correct the permissions and write a dummy text file to check for in future logons to save the hassle of recorrecting the perms every time.

 

\\server\share$ would be the name and share of the home folder location

domain\group would be your domain and group name you either want to add or remove.

 

If exist "\\server\share$\%username%\logon.txt" goto exit

 

 

REM Apply correct security settings to students folders

xcacls \\server\share$\%username% /t /c /g %username%:f "domain\administrator group":f "creator owner":f system:f /y

 

REM remove groups from folders

xcacls \\server\share$\%username% /e /t /r "domain\group"

Date /t >\\server\share$\%username%\logon.txt

 

:exit