Setting permissions on a folder and pushing them down

[FatBoy]

Hi all,

 

I have been trying to get a script working so that it changes the permissions on a installed program folder (Oxford University Press) so that everyone has read/write permissions to it (Otherwise only admins can run the program). So far I, with a lot of help have this:

 

varfolder = "c:\Program Files\Oxford University Press"

 

SET fs = WScript.CreateObject("Scripting.FileSystemObject")

SET WshShell = CreateObject("WScript.Shell")

 

If NOT fs.FolderExists(varfolder & "\ok.txt") then 'checks if code should run

fs.CopyFile "\\servername\share\eSongbirds\MSI\ADsSecurity.dll", "C:\WINDOWS\system32\" 'copies dll over to PC

fs.CopyFile "\\servername\share\eSongbirds\MSI\ok.txt", "c:\Program Files\Oxford University Press\" 'copies ok.txt to folder

WshShell.run "regsvr32 /s C:\WINDOWS\system32\ADsSecurity.dll", True 'registers the dll

 

SET objsecurity = createobject("adssecurity") 'invokes the dll

SET objsd = objsecurity.getsecuritydescriptor("file://" & varfolder) 'picks up varfolder

SET objdacl = objsd.discretionaryacl 'creates acl

 

SET objnewace = createobject("accesscontrolentry") ' makes the ace

 

objnewace.trustee = "Everyone" 'who your assigning permission to

objnewace.accessmask = 2032127 ' full control

objnewace.acetype = acetype_access_allowed

objnewace.aceflags = 3 ' files folders and subfolders

objdacl.addace objnewace 'adds ace to acl

 

objsd.discretionaryacl = objdacl

objsecurity.setsecuritydescriptor objsd

 

else

msgbox("no folder exist")

End if

 

It all works ok apart from it doesn't push the permissons down to the folders and files below, it only adds everyone to the root folder (Oxford University Press) I thought the "objnewace.aceflags = 3" code would do it but it doesn't can anyone help?

 

Thanks

[AliG]

You could use GPO for this too. Computer Config - Windows settings - Security Settings - File system. If the path does not exist on the server/pc you are editing GPO on just create a dummy folder of it.

 

Enjoy!

[srochford]

I'd definitely do it with the GPO but the script that I've used in the past uses value 2 (ADS_ACEFLAG_INHERIT_ACE) to get the perms inherited.

 

The MSDN website gives the definitions of the various flag constants.

[FatBoy]

Thanks AliG thats spot on never new about this policy cheers for the info also srochford

[TechSupp]

eSongbirds! I recently had the fun job of installing that one around the school. I just made an msi for all the disks and then pushed it out. Didn't have the same trouble as you as we have other progs that require local admin rights to run Grrrr... Good to see that scripts as I may need something like that in the future.

[buzzard]

Defo use the GPO much simpler to manage, but beware this can easily be applied to the entire network rather then the few computers you want! Just use the security filtering on the GP to narrow down where it applies.