Need some serious help fast: Redirected folder permissions/exclusive rights aftermath

[Garacesh]

• I accidentally left the Grant user exclusive rights to Documents (and Pictures, Videos, etc) ticked when I recreated group policy for our kids. I've unchecked that box now, but I'm locked out of the redirected portion of their home folders.
  
• My test account has started getting errors about the Recycle Bin being corrupt in the redirected folders.
  
• My test account has been granted Full Control of its homefolder on the file server. I have gone into the AD User Account and re-set the homefolder location and given the user Full Control that way. This is confirmed by Right-Click, Properties, Security. My test user has full control.
  
• I have taken ownership of all of the pupil files and folders with my Domain Administrator account using this Take Ownership script.
  
• If I Right Click, Properties, Security, Advanced, Replace all child object permission entries with inheritable permission entries from this object on their homefolder (\\FileServer\...\%USERNAME%\), this grants my regular account access to the redirected folders (Downloads, Pictures et al) and stops the corrupted recycle bin error from appearing.
  

 

The problem is, I have 1200 kids to do this to.. That's a lot of manual recovery needing done.. Is there any way I can fix this?

 

(EduGeek really needs an Active Directory/Group Policy section...)

Edited July 5, 2016 by Garacesh

[Joanne]

can you not do it on the folder that holds these and propigate down through the file structure? Then in AD, choose the kids, go to profile, home drive and type in the location \\server\pupil home\intake12\%username%

 

There is probably a script that does it like...

[Garacesh]

can you not do it on the folder that holds these and propigate down through the file structure? Then in AD, choose the kids, go to profile, home drive and type in the location \\server\pupil home\intake12\%username%

 

There is probably a script that does it like...

Hmm.. Maybe. Propagate no permissions to it, and then run a script that takes the folder name variable and sets that as full control...

That'll be an after-hours job, but it's possible.. I do already have a script that assigns a user full control that I use for creating accounts en-masse each year..

[Joanne]

Yeah you have to do it when peeps be logged out ideally.

[dapaulio]

I created this script to help me create and share user home folders from a csv.

You need a 2 column csv for this script

%%a = Username

%%b = Physical path to the home path

 

You will also need to download xcacls.exe and rmtshare.exe and save them on to the file server (if you need me to send them to you let me know.)

Please test it first though and a small selection of test accounts. what works for me may not work for you

 

Good luck

 

for /f "eol=; Tokens=1,2,3,4,5,6,7,8 Delims=," %%a in (%1) do (
md D:\homes\%%b\%%a\mywork
"C:\Utilities\rmtshare.exe" \\server\%%a$ = d:\homes\%%b\%%a /grant everyone:f

Echo.########### Students ###########
"C:\Utilities\xcacls.exe" "d:\homes\%%b\%%a" /c /y /t /g "domain\%%a":f;f "domain\Domain Admins":f;f "Admins - RO Home Directories (students)":RO;RO "Admins - RW Home Directories (students)":RW;RW

rem Echo.########### Staff ###########
rem "C:\Utilities\xcacls.exe" "d:\homes\%%b\%%a" /c /y /t /g "domain\%%a":f;f "domain\Domain Admins":f;f "Admins - RO rem Home Directories (staff)":RO;RO "Admins - RW Home Directories (staff)":RW;RW

rem Echo.########### Other ###########
rem "C:\xcacls.exe" "d:\homes\%%b\%%a" /c /y /t /g "domain\%%a":f;f "domain\Domain Admins":f;f
)

[Garacesh]

We have our users arranged by \\FileServer\....\4-digit-year-of-entry\%USERNAME%, so I'll have to run this against each yeargroup individually, but it should do the trick. I don't want to include the -recurse switch because then it'll keep looking inside user folders too.

 

$FolderLocation = (Read-Host 'Pupil Homefolder Directory') 		# Provide script with the root directory containing each users' homefolder
ForEach ($Folder in Get-ChildItem  $FolderLocation\) {		# For each folder inside that root directory
	$ACL = (Get-ACL -Path $Folder)		# Get Access Control List for that folder
	$FullControlAccessRule = (New-Object System.Security.AccessControl.FileSystemAccessRule([system.Security.Principal.NTAccount]"DOMAIN\$Folder","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow"))		# Create an access rule granting the user full permissions
	$ACL.AddAccessRule($FullControlAccessRule)		# Add new settings to current access control list
	Set-ACL -Path $Folder $ACL		# Overwrite current ACL with new one, granting user full control
}

 

Leaving this here in case anybody gets stuck in a similar state in the future

This script works for my test environment.. Might need modifications for other environments based on your network setup.

Obviously this script will not work if your users homefolder name is not their username.

Edited July 5, 2016 by Garacesh

[dapaulio]

going to steal this myself. iv been using batch scripting for years, has never failed me which is the main reason I have not rewritten with PS however I think it is about time i start using it more

 

glad you got it sorted

[Garacesh]

Always be sure to run it against test environments first. My 'copy' has hard-baked directories into it (instead of asking for a full path it just asks for a yeargroup and enumerates on that) so the variables might not quite line up in the script I posted. Modify as required

[3s-gtech]

[*]I accidentally left the Grant user exclusive rights to Documents (and Pictures, Videos, etc) ticked when I recreated group policy for our kids. I've unchecked that box now, but I'm locked out of the redirected portion of their home folders.

 

This stupid tickbox. I think I did it by changing the root Ownership and propogating it down but it was a couple of years back, so struggling to remember. Once that's done NTFS permissions and Owner values were stuffed on all sub directories, but that was fixed in minutes using Chown and NTFSFix.

[DavetheITguy]

Use NTFS fix tool, it's brilliant for things like that, you can either ADD bulk permissions or REPLACE all permissions on single folders or top level.

 

http://www.wisesoft.co.uk/software/ntfsfix/default.aspx

[3s-gtech]

I'll just add the reminder - you can't install NTFSFix on anything newer than Windows 7/Server 2008 R2 as the installer is built with .NET 1.1. However, you can extract the .exe or install it on another PC and copy the executable across to a Server 2012 R2 system, as the exe uses .NET 2.0.

[Garacesh]

My script fixed it for me

 

There were a few errors that I'll be digging into tomorrow, when it did error, it's because no account existed carrying the same name as the folder. A few of those I narrowed down to accounts created in error, or test accounts that don't exist anymore, the rest I presume are kids who have had their names changed, and I'll be following that up.

[DavetheITguy]

You can install it 2008 and above, I have NTFSfix installed on Server 2012 and it works fine, I've been using this for ages without issue.