Changing file permissions on Kids work so staff can write.

[tosca925]

We have a folder structure like this \\server\homedirs\entry2005\Joe bloggs

 

Inside Joe bloggs folder is a folder for each subject they do ie; maths English, science, etc etc. Obviously inside the folder they have the relevant work.

 

I have set the permissions on this to , Administrators Full control, user full control and staff read,. We did this because staff kept browsing the kids home dirs and accidentally dropping users in side each other ( all fingers and thumbs on their laptop mouse pads)

 

I have now had a request form 2 depts that they want to mark the kids work online so they need write access to their documents.

 

I need to change the permission so that staff only have write permission on the documents inside their subject folders and not anywhere higher up the structure to stop them dragging and dropping folders.

 

Any advice.

[ajbritton]

The trick is to change the 'Apply To' setting, which is only available in the Advanced dialog box. Using this, you can change how permissions are applied. The default is that the permissions affect 'This folder, subfolders and files' - This is the default setting, and will affect the folder itself as well as all files/folders within it that are inheriting permissions. If you change the setting to 'Subfolders and files', then the user only gets permissions on files/folders within the folder on which the permission is set. This should prevent them from moving it.

[tosca925]

NOt sure i understand but can this be done in a script?

[MkII]

I presume the easiest way would be to set the permissions on each of your year group folders [under 'homedirs']: \\server\homedirs\entry2005\

[ajbritton]

I assume you want the teachers to have full access to the contents of each user directory, but not to the directory itself. Setting the permission on the user directory, but changing 'apply to' to 'subfolders and files only' means the teacher can still do whatever they want to files/folders within the user folder but will not necessarily have any power over the folder itself.

 

As to wether it can be done from a script...Yes, anythings possible. If you are a certified genius, you can attempt to use the ADSSecurity.dll in the ADSI SDK. An easier way might be to use SETACL (an open source access control list command line tool).

 

I've done a single quick test, and the following appears to produce the desired results

setacl -on "D:\USERS\INTAKE2005\USER01" -ot file -actn ace -ace "n:Teachers;p:change;s:n;i:so,sc,io;m:set;w:dacl

[tosca925]

Thanks AJ, but still a bit over my head ........sorry.

 

Waht iwould like ideally is to haev chaneg permission on documents only and nt let staff drag or drop folders. (in a ideeal world)

[ajbritton]

Sorry Tosca, I thought you meant change to all files/folders under the user root folder, but not on the root folder itself (which would prevent the dropping one user folder into the another).

 

Let me see if I understand now. You want Teachers to have change on the documents (regardless of which folder they are in) but not be able to do anything to the existing folder structure. Am I getting close..?

[tosca925]

Yes very close.

 

I want the structure to stay intact so that folders cannot be accidently dropped

into each other. But iwant satff to be able to write or change the documents inside the various folders.

 

Don't even know if its possible.

[ajbritton]

It's possible. I'll figure out the SetACL command and get back to you.

[tosca925]

cheers m8

[Ric_]

I can't try this out at the moment, but would 'modify' permissions allow the required access to the files without allowing the directory structure to be changed?

 

The Microsoft XCACLS script would allow you to simply add this to all files and subfolders.

 

Just thinking out loud but it may help you to think of the answer.

 

You should also bear in mind that allowing staff to alter the kids files could allow 'cheating' so you would need some policies in place to protect the school's back.

 

Another option would be to use email or shared folders to hand in files.

[pete]

When implementing this, bear in mind that there are teachers out there who will delete vast swathes of $important_shared_volume and only mention this after the summer holidays, when the backups have been overwritten (and volume shadow copy has nixed by a defrag).

 

If a kid isn't a regular computer user, they might not notice teacher daftness until too late.

 

I second the "handing stuff in" shared folder / email idea.

[tarquel]

As we've mentioned in a previous thread the dangers of allowing write permissions for staff on pupil home dirs [someone care to find it for me], i 3rd the shared folder or email submission idea.

 

Alas, our pupils misused the email system so only 6th form and staff have access to email here [not my decision] so this rules out the option for us, but i have used the shared folder idea with success with IT coursework in the past. The ICT co-ord was fine with it and understood how giving write/modify permissions to staff could be misused.

 

Regards

Nath.

[Ric_]

The other option is to use a VLE such as Moodle (less of a quick fix and a change to the way ICT is used in school). The advantage of a VLE is that it will also store the marks given and multi-guess type questions can be added too.

[ajbritton]

It sounds like good advice to prevent non-technical staff from mucking about in student folders, but if you still really want to do it, here's the command. Note that this can be set on the root folder that contains the student folders, rather than having to run it against every students folder individually.

 

NB - Please test this before running it against the actual student folders. When I tried it, existing permissions were unaffected, but I'm still only 85% sure that I know what's really going on with permission inheritence etc.

 

SetACL -on "D:\Users\Intake2005" -ot file -actn ace -ace "n:Teachers;p:change;i:so,io"

 

The key thing in the command is in the -ace string. There are 3 sub-parameters specified;

 

n:Teachers

- This parameter specifies the (n)ame of the trustee to whom permissions are being granted/denied

 

p:change

- This parameter specified the actual (p)ermissions being set

 

i:so,io

- This parameter specified the inheritence. In this instance 'so' sub-objects (ie files) and 'io' inherit only.

[tosca925]

Cheers AJ i will try this tomorrow if i get chance

[ajbritton]

I should also have pointed out that you don't actually need SetACL to do this now as it can be done from the root directory which contains all your student folders ie. intake2005.

 

1 - To do this via the Windows, browse to one of the root folders eg intake2005 and bring up the file/folder security dialog.

 

2 - Add the Teachers group into the list and give the group the required access eg. Modify

 

3 - Click the Advanced button, select the Teachers group and click Edit

 

4 - Change the 'Apply Onto' setting to 'Files only'

 

5 - OK, OK, OK

 

Should have the same effect as the SetACL line.