Change ownership of multiple folders (user home folders)

[itgeek]

Hi,

 

I need to change permissions on multiple user home folders to work with windows 10 folder redirection.

 

I need to make the students owners of the home drives however how can I do this in bulk and still allow administrator access to the folders?

 

 

Thank you for your help.

[strawberry]

wisesoft.

 

NTFSFix

[3s-gtech]

Ownership itself can be set with the Chown command line utility for bulk jobs.

[BKGarry]

The CACLS command line tool can do this.

 

When I am in work tomorrow I will knock together an excel sheet where you can put in the path and the folder name, and assuming it is the same as the username, you will be able to copy the last column into notepad and run on the file server.

[Garacesh]

I wrote a script to do this a while ago..

Assuming that their username is the same as the folder name (i.e. documents is mapped to \\server\path\%USERNAME%)

 

Import-Module ActiveDirectory
ForEach ($Folder in Get-ChildItem  "[color="#FF0000"]YOUR ROOT DOCUMENTS DIRECTORY[/color]") {		# For each folder inside that root directory
	$ACL = (Get-ACL -Path  [color="#FF0000"]YOUR ROOT DOCUMENTS DIRECTORY[/color]\$Folder)		# Get Access Control List for that folder
	$FullControlAccessRule = (New-Object System.Security.AccessControl.FileSystemAccessRule([system.Security.Principal.NTAccount]"[color="#FF0000"]YOUR DOMAIN[/color]\$Folder","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow"))		# Create an access rule granting the user full permissions
	$ACL.AddAccessRule($FullControlAccessRule)		                # Add new settings to current access control list
	Set-ACL -Path [color="#FF0000"]YOUR ROOT DOCUMENTS DIRECTORY[/color]\$Folder $ACL		    # Overwrite current ACL with new one, granting user full control
}

[BKGarry]

I would use @Garacesh 's script, that is a lot cleaner

[Rob_D]

Doesn't resetting the home folder in AD Users & Computers fix the file permissions. If you've got something like \\server\share\%username% then it's easy to do en-mass.

I've done it before by "changing the path from the resolved "\\server\share\jsmith" back to "\\server\share\%USERNAME%" (while it resolves back to the same thing the console treats it like a new value).

[Garacesh]

Doesn't resetting the home folder in AD Users & Computers fix the file permissions. If you've got something like \\server\share\%username% then it's easy to do en-mass.

I've done it before by "changing the path from the resolved "\\server\share\jsmith" back to "\\server\share\%USERNAME%" (while it resolves back to the same thing the console treats it like a new value).

 

As soon as you change something the 'Apply' button is enabled, so I usually just delete the first \, add it back in, then apply. It doesn't bother to check that the new path is different to the old one, it just knows 'something changed' and applies the change.

It does give you a popup saying "Yo, this folder already exists, do you wanna give this user full control?" but doing that manually for every pupil would be a pain in the backside, I'd imagine.

[Rob_D]

As soon as you change something the 'Apply' button is enabled, so I usually just delete the first \, add it back in, then apply. It doesn't bother to check that the new path is different to the old one, it just knows 'something changed' and applies the change.

It does give you a popup saying "Yo, this folder already exists, do you wanna give this user full control?" but doing that manually for every pupil would be a pain in the backside, I'd imagine.

 

Cool, I never noticed you could apply without really changing anything.

 

As long as everyone has the same path (bar the %username% bit) you should be able to make the "change" to multiple accounts at once. I've done it for a whole class at once before without any issues.

[Garacesh]

As long as everyone has the same path (bar the %username% bit) you should be able to make the "change" to multiple accounts at once. I've done it for a whole class at once before without any issues.

Huh, interesting! I didn't realise you could modify multiple users at once.

[itgeek]

Thanks for all the help. If I modify the AD field this wont give them ownership of the home directory? This is for folder redirection windows 10. I have changed the permissions on a couple of users and it fixes the folder redirection.

 

Thanks

[Garacesh]

Thanks for all the help. If I modify the AD field this wont give them ownership of the home directory? This is for folder redirection windows 10. I have changed the permissions on a couple of users and it fixes the folder redirection.

What exactly is your setup @itgeek?

 

We map a drive via the Profile tab of the User object in AD (e.g. map Z: to \\File_server\path\%USERNAME%) and then use Group Policy to map documents/pictures/etc to Z:\Documents, Z:\Pictures etc.

This gives them full control over their own individual folder (so user BloggsJ gets full control of \\File_server\path\BloggsJ) but it doesn't grant them any permissions on the root directory (\\File_server\path). The kids don't even have any permissions at all on the root folder, they don't even need folder traversal.

 

Assuming their folder is named the same as their username, my script should still work no matter where you point it at.

 

Just make sure you run it as a user that's able to see the User OU's and has permission to modify ACL's on the root directory.

 

If you want to be SOOOPER safe, remove everybody's permissions (except yours) on the root directory and tell those permissions to propagate downwards. Then run the script.

(In fact, that's exactly why I crafted the script.. Permissions were buggered, thanks CAPITA, and if you were clever you could traverse back to the root folder and into someone else's documents..)

Edited December 11, 2019 by Garacesh

[itgeek]

Hi,

 

Thanks for the reply. I have been setting up folder redirection however I could not get this to work so I right clicked on the users home directory and selected the security and advanced. I made the user the owner of the home folder. This resolved the folder redirection however administrators are not able to access the folder. Would the script that you provided work?

 

 

Thanks again for your help.