Script to change NTFS permissions

[FN-GM]

Hi,

 

I need a script that will give a group called btc\staff_sims_updates full permissions on the sims folder in program files.

 

I wonder if someone cna help

 

Thanks

[MattCrick]

cacls "C:\program files\SIMS" /E /T /C /G "btc\staff_sims_updates":C

 

in a batch file or as part of your logon script

 

Works for us...

 

Matt

[SYNACK]

If this is for client machines just use the file system security bit in a GPO which results in a much cleaner implementation and does not require any scripting at all.

 

applying folder permissions through group policy

computer configuration/windows settings/security settings/file system

 

Right click add file, then you browse to the folder (if it is being done on the server and the folder is not there cerate it so you can find the path then you can set the permissions by double clicking the folder in the file system

[FN-GM]

Hi,

I have altered it so it will give full permisions and remove existing groups here is my code

 

"C:\program files\SIMS" /T /C /G "btc\staff_sims_updates":f

 

but it is prompting for a yes or no. How would i make it so it automatically says yes?

 

thanks

[dwhyte85]

Here is a snippet of something that does similar that i modified, some vars aren't needed but you get the idea, could alter as needed:

 

 

 

 

Dim objFSO
Set objFSO = CreateObject("Scripting.FileSystemObject")
dim pos
Set objRoot = GetObject("LDAP://RootDSE") 
strDNC = objRoot.Get("DefaultNamingContext") 
Set objDomain = GetObject("LDAP://" & strDNC) ' Bind to the top of the Domain using LDAP using ROotDSE 
Dim fso
Set fso = CreateObject("Scripting.FileSystemObject")
Set wshShell = WScript.CreateObject ("WSCript.shell")

''''''''''''''''''''''''''''
Call enummembers(objDomain)'
''''''''''''''''''''''''''''

Sub enumMembers(objDomain) 
On Error Resume Next 

For Each objMember In objDomain ' go through the collection 



If ObjMember.Class = "user" Then 

SamAccountName = ObjMember.samAccountName 


[b]strDetail = "xcacls a:\path-to-folder /e /g "&SamAccountName&":F /y"[/b]
wshshell.run strDetail,7, true

''''''''''''''''''

If objMember.Class = "organizationalUnit" or OBjMember.Class = "container" Then 
strDetail = objmember.adspath
[b]pos=InStr(1,strDetail,"SOME-OU",0) [/b]
if pos > 0 then
     enumMembers (objMember) 

end if
end if

 

the 2 bolded bits are important, first one is path to folder that you want to add NTFS permissions, latter is to enumerate through an OU on AD, so you could go through the 'teachers' OU when ran on the DC, well i invoke through a scheduled task and it does something slightly different - similar in principal! This was made for something tottallly different but not alot of difference in what it does.

Edited March 18, 2009 by dwhyte85

[MattCrick]

Modify perms should be sufficient to enable the user to update SIMS.

[notalot]

If your trying to get users to update sims without being an admin i bleave there is a bat in sims\setups called simsperm you use it like this if its there

 

I:\Sims\Setups\Simsperm.bat "Domain\Group"

 

where I:\ is the share for your sims server

[box_l]

i do the above (simsperms.bat), but i use mine as a startupscript in a gpo for the staff workstations.

 

 

Create new group policy called simsperms

Go to windows startup scripts (machine settings)

Click Show files

Paste in subinacl.exe and the .bat file

Copy path from the window

Eg.

\\schoolname.county.sch.uk\SysVol\schoolname.county.sch.uk\Policies\{5BB037E4-9025-4685-A436-5D003B249635}\Machine\Scripts\Startup\

In the .bat prepend to all lines stating with subinacl

Eg.

subinacl /SUBDIRECTORIES "%ALLUSERSPROFILE%\Start Menu\Programs\SIMS Applications" /GRANT=%1=F

becomes

\\schoolname.county.sch.uk\SysVol\schoolname.county.sch.uk\Policies\{5BB037E4-9025-4685-A436-5D003B249635}\Machine\Scripts\Startup\subinacl /SUBDIRECTORIES "%ALLUSERSPROFILE%\Start Menu\Programs\SIMS Applications" /GRANT=%1=F

 

Or you could use:

Set simsgpopath=\\schoolname.county.sch.uk\SysVol\schoolname.county.sch.uk\Policies\{5BB037E4-9025-4685-A436-5D003B249635}\Machine\Scripts\Startup

which means you could do

%simsgpopath%\subinacl /FILE "%ALLUSERSPROFILE%\Start Menu\Programs\SIMS Applications" /GRANT=%1=F

 

save file

apply parameters to script in the form domain\security group

 

 

 

That should do it.