HELP! Home Drive Permissions Gone...

[GRitchie]

Essentially, staff were wanting to be able to see the students home drives, so I attempt to set the permissions last night (which worked) but resultantly wiped the permission for students to save in their own area.

 

Is there a way I can regrant the permissions, quickly?

 

I tried selecting the users, and repointing the home drive as \\server\share\%username% but it sees it as already existing.

 

 

Think I’ve learned a pretty big lesson from this mistake…

[Steve21]

Think I’ve learned a pretty big lesson from this mistake…

 

See slow and steady wins the race! Too easy to jump into a new role and want to change lots but causes way more hassle than it's worth haha

 

But in reality unless you script it all or bodge it, you'd probably be quicker restoring last nights backup. As assuming no-one could save new work into it today anyway?

 

If you want to script it you'd need to look at picking the folder names, and using that as the owner thats set on each folder etc, then make staff top level have read access and inherit it down

 

Steve

[Steve21]

Found my old script to fix some before, this sets all folder names as modify on their own folders:

 

#############################################################################
# Script: changePermissions.ps1
# Author: Internet & Luis Goncalves & Rui Duarte
# Date: 17/07/2013
# Keywords:
# Comments:
# Pre-Requisites: Full Control over destination folder.
#
#
# DISCLAIMER
# ==========
# THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE
# RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER.
#############################################################################

# ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?
#            Variables
#
# Where is the root of the home drives?
$homeDrivesDir="F:\Documents"
# Report only? ($false = fix problems)
$reportMode = $false
# Print all valid directories?
$verbose = $false
# What domain are your users in?
$domainName = "MYDOM"
#
#######################################################################

# Save the current working directory before we change it (purely for convenience)
pushd .
# Change to the location of the home drives
set-location $homeDrivesDir

# Warn the user if we will be fixing or just reporting on problems
write-host ""

if ($reportMode) {
Write-Host "Report mode is on. Not fixing problems"
} else {
Write-Host "Report mode is off. Will fix problems"
}

write-host ""

# Initialise a few counter variables. Only useful for multiple executions from the same session
$goodPermissions = $unfixablePermissions = $fixedPermissions = $badPermissions = 0
$failedFolders = @()

# For every folder in the $homeDrivesDir folder
foreach($homeFolder in (Get-ChildItem $homeDrivesDir | Where {$_.psIsContainer -eq $true})) {

# dump the current ACL in a variable

$acl= (Get-Item $homeFolder).GetAccessControl("Access")
#$Acl = Get-Acl $homeFolder

# create a permission mask in the form of DOMAIN\Username where Username=foldername
#    (adjust as necessary if your home folders are not exactly your usernames)
$compareString = "*" + $domainName + "\" + $homeFolder.Name + " Allow  Modify*"

# if the permission mask is in the ACL
if ($Acl.AccessToString -like $compareString) {

# everything's good, increment the counter and move on.
if ($verbose) {Write-Host "Permissions are valid for" $homeFolder.Name -backgroundcolor green -foregroundcolor white}
$goodPermissions += 1

} else {

# Permissions are invalid, either fix or report
# increment the number of permissions needing repair
$badPermissions += 1
# if we're in report mode
if ($reportMode -eq $true) {
# reportmode is on, don't do anything
Write-Host "Permissions not valid for" $homeFolder.Name -backgroundcolor red -foregroundcolor white
} else {
# reportmode is off, fix the permissions
Write-Host "Setting permissions for" $homeFolder.Name -foregroundcolor white -backgroundcolor red
# Add the user in format DOMAIN\Username
$username = $domainName + "\" + $homeFolder.Name
# Grant the user full control
$accessLevel = "Modify"
# Should permissions be inherited from above?
$inheritanceFlags = "ContainerInherit, ObjectInherit"
#$inheritanceFlags = "None" 
# Should permissions propagate to below?
$propagationFlags = "None"
# Is this an Allow/Deny entry?
$accessControlType = "Allow"
try {
# Create the Access Rule
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($username,$accessLevel,$inheritanceFlags,$propagationFlags,$accessControlType)

# Attempt to apply the access rule to the ACL
$Acl.SetAccessRule($accessRule)
Set-Acl -Path $homeFolder -AclObject $Acl
# if it hasn't errored out by now, increment the counter
$fixedPermissions += 1
} catch {
# It failed!
# Increment the fail count
$unfixablePermissions += 1
# and add the folder to the list of failed folders
$failedFolders += $homeFolder
}
} #/if
} #/if
} #/foreach

# Print out a summary

Write-Host ""
Write-Host $goodPermissions "valid permissions"
Write-Host $badPermissions "permissions needing repair"
if ($reportMode -eq $false) {Write-Host $fixedPermissions "permissions fixed"}
if ($unfixablePermissions -gt 0) {
Write-Host $unfixablePermissions "ACLs could not be repaired."
foreach ($folder in $failedFolders) {Write-Host " -" $folder}
}

# Cleanup
popd

 

that any use? I changed it to only modify rather than full control though

 

Steve

 

- - - Updated - - -

 

If you change the "report" to true, it'll go through and show you what it would do without actually doing it.

 

Steve

[GRitchie]

Best of it was, it was because of teacher requests that I did it. I'm usually pretty good with permissions, but a lapse in concentration was probably what caused it!

 

So just use VEEAM to restore the entire 'pupils' folder? But it would be 2 days ago, as last night would be broken.

[cscc]

NTFSFix

 

NTFS Fix is very helpful if your folder names match corresponding usernames.

 

Also run the following in a batch file in the root of the problematic folder with a copy of subinacl.exe and it will grant ownership to the user/foldername providing they are the same:

 

   @echo off
setlocal
set fold="*"
set fold=%fold:"=%
for /F "tokens=*" %%i in ('dir "%1" /b /ad') do call :UPERM "%%i"
endlocal
goto end:
:UPERM
set user=%1
set user=%user:"=%
 SubInACL /subdirectories %1 /setowner=%1
 goto end

:end

Edited January 29, 2016 by cscc

[GRitchie]

Trying that script now @cscc - looks the easiest suggestion so far

 

The WiseSoft stuff I've had good experience with, but that one looks a bit confusing if I'm honest!

[dapaulio]

you will need to export a list users in cmd prompt by doing a dir >> users.csv in the root of the folder you have stript permissions out of then tidy the csv up

 

Column A - Username

Column B - Password - Unused in this case

Column C - Directory path to the user folder eg d:\homes\students\2010intake

 

download rmtshare.exe (shares the folder) and xcacls.exe (sets NT permissions) on to your file server

 

###UserPermissions.cmd###

for /f "eol=; Tokens=1,2,3,4,5,6,7,8 Delims=," %%a in (%1) do (

md %%c\%%a\mywork

"C:\Utilities\rmtshare.exe" \\server\%%a$ = %%c\%%a /grant everyone:f

"C:\Utilities\xcacls.exe" "%%c\%%a" /c /y /t /g "domain\%%a":f;f "domain\Domain Admins":f;f "Admins - RO Home Directories (students)":RO;RO "Admins - RW Home Directories (students)":RWED;RWED

rem echo "%%a = Migration Complete" > \\server\%%a$\MigrationStatus.txt

)

[/Code]
 

you will need to tweek the script to suit your network

if the shares are entact then you can ignore the rmtshare line as this effectively just shares the folder

change the groups in xcacls.exe line to match your network and the permissions you want to give
 

in elevated cmd prompt 

userpermissions.cmd users.csv

Edited January 29, 2016 by dapaulio

[GRitchie]

SubInACL script seems to have done it (for at least the majority) thanks @cscc.

I will have to manually re-assign the owner of the odd user where it hasn't worked, but that's fine.

 

Thanks guys!