Mass creating a folder with student permissions

[zag]

I've got a special share that we use for our computer science students to compile executables on.

 

I can create a folder manually with the students username and apply permissions to it for that student only.

 

Is there any quicker way to do this? I really don't fancy doing 200 of these!

Edited March 27, 2017 by zag

[glen_j]

you could set the home path to the new share using the %username% vairable at the end. it would then create the folders with correct permissions the same way the home directories are created then switch them back. I've used that method before with good results.

[Fazza]

I know you can use the icacls command to set permissions via a command prompt so you must be able to script it by using a text file full of the usernames and then create a batch file to look up a name one at a time from the file, create a folder and then use the icacls command to apply the permissions.

 

No idea how I'm afraid but it might give some other person an idea how to do it.

[3s-gtech]

You can use NTFSFix to do this fairly easily, if each folder shares its name with the username of the student.

[mavhc]

I assume you mean NTFSFix and not the linux program

[3s-gtech]

I do indeed. It's very old now, and the installer won't run on anything post XP. The actual program executable works fine on 2012 R2 though (it requires .NET 2.0, where the installer needs 1.1). It's a great piece of software - I use it every year to bulk fix the permissions for our new user folders.

[mavhc]

I used 7zip to open the download, then uniextract to extract the 2 files.

[FN-GM]

Do you have the commands if it was one user?

 

If so get a list a of usernames and build a list of user specific commands in Excel using the concatenate function.

[Fazza]

Do you have the commands if it was one user?

 

I do!

 

md "e:\users\students\user001"
icacls "e:\users\students\user001" /grant "user001":(OI)(CI)M

 

No idea how to get it to look up the username from an excel spreadsheet though.

Edited March 28, 2017 by Fazza

[FN-GM]

@Fazza Do you have it in coding wraps please?

[Arthur]

md "e:\users\students\user001"
icacls "e:\users\students\user001" /grant "user001":(OI)(CI)M

I do.

[zag]

I do indeed. It's very old now, and the installer won't run on anything post XP. The actual program executable works fine on 2012 R2 though (it requires .NET 2.0, where the installer needs 1.1). It's a great piece of software - I use it every year to bulk fix the permissions for our new user folders.

 

Any guide on how it works, its slightly confusing!

[3s-gtech]

Yup. Select Replace. Build the list of permissions (domain\%foldername%, domain\administrators, perhaps domain\teachers group) with the appropriate access for each. Then select the root folder you want to apply the permissions to and right-click/Exclude folders on the sub-folders you don't want to change.

 

domain\%foldername% is the important syntax.

[Sephiroth]

I'd do it in powershell like this;

 

$Users = Import-CSV -Path "\\Path\To\File.csv"

Foreach ($User in $Users) {
   $Username = $User.Name
   $DirectoryPath = "\\Path\to\directory\containing\$Username"
   $UserPerm = "ShortDomain\$Username"

   New-Item $DirectoryPath -type directory

   $acl = Get-Acl "$DirectoryPath"
   $permission = $UserPerm,"Modify","ContainerInherit,ObjectInherit","None","Allow"
   $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
   $acl.SetAccessRule($accessRule)
   $acl | Set-Acl "$DirectoryPath"
}

 

Using a CSV with a single column titled 'Name' with usernames in it.

Edited March 28, 2017 by Sephiroth

[zag]

Thanks, I managed to get NTFSfix to work with basically 1 click!

 

All permissions set as expected. This saves me quite a bit of work!

 

Amazing

 

Here is the app extracted if anyone else needs it.

 

NTFSfix

[AlanD]

Can't help but think...I wouldnt be allowing any folder on a school network for user created executables....how would you stop them putting any other executable there? Surely the solution to this is a virtual PC ...and one which does not have any access to the network.

[zag]

Can't help but think...I wouldnt be allowing any folder on a school network for user created executables....how would you stop them putting any other executable there? Surely the solution to this is a virtual PC ...and one which does not have any access to the network.

 

We have FSRM setup to email me on every file executable saved there. Its a constant log which I check each week.

 

The students know this and get their account shut down right away if they save anything there. System works surprisingly well.

[mavhc]

Give them all their own digital signing key, only allow those keys to bypass srp, as well as logging every time they're run