NTFS Bulk Permissions Help!

[ict_support]

This is excellent saved me heps of work

[pnlrogue1]

Thanks for all of the interest in this but I was just wondering how it could be modified slightly - at the moment, it works great for giving the students/staff access to their respective folders, but how could it be changed to give Administrator access without having to go through and take ownership? Would it be something like this:

 

E:
cd \Users\Students\Work\Intake07\ 
for /d %i in (*) do cacls %i /e /t /g %i:c
for /d %i in (*) do cacls %i /e /t /g Administrator:c

 

Could I also add a line for the Domain Admins group by taking the line with administrator and replacing it with "Domain Admins" (in speech marks, presumably) giving us:

 

E:
cd \Users\Students\Work\Intake07\ 
for /d %i in (*) do cacls %i /e /t /g %i:c
for /d %i in (*) do cacls %i /e /t /g Administrator:c
for /d %i in (*) do cacls %i /e /t /g "Domain Admins":c

 

Thanks!

[cookie_monster]

@ mac_shinobi, sorry I didn't see that reply.

 

Just go to the share and right click it then add a group with all students in and uncheck the 'full control' box and check the 'Change' box. You can also add staff groups so they could have full control.

 

Windows 2003 Share Permissions

 

Windows 2000/2003 NTFS and Share Permissions

[srochford]

Thanks for all of the interest in this but I was just wondering how it could be modified slightly - at the moment, it works great for giving the students/staff access to their respective folders, but how could it be changed to give Administrator access without having to go through and take ownership?

E:
cd \Users\Students\Work\Intake07\ 
for /d %i in (*) do cacls %i /e /t /g %i:c
for /d %i in (*) do cacls %i /e /t /g Administrator:c
for /d %i in (*) do cacls %i /e /t /g "Domain Admins":c

 

 

Yes, but you can simplify it and speed it up:

 

 

for /d %i in (*) do cacls %i /e /t /g %i:c administrator:c "domain admins":f

 

not too relevant on a server which will probably always stay in the domain, but it can be better to set the permissions to the local group rather than domain (assuming that you add domain admins to local administrators group)

[pnlrogue1]

Yes, but you can simplify it and speed it up:

 

 

for /d %i in (*) do cacls %i /e /t /g %i:c administrator:c "domain admins":f

 

not too relevant on a server which will probably always stay in the domain, but it can be better to set the permissions to the local group rather than domain (assuming that you add domain admins to local administrators group)

 

We inherited an RM network so we just try to keep it running! One of the things the RM systems do is make Administrators and Domain Admins really powerful and not use the local admins!

 

Thanks for your feedback and advice

[adamu]

thank you to everyone, I had the same problem. Great to have a thread with a number of clear solutions, perhaps it could be made a sticky?

[mac_shinobi]

@ mac_shinobi, sorry I didn't see that reply.

 

Just go to the share and right click it then add a group with all students in and uncheck the 'full control' box and check the 'Change' box. You can also add staff groups so they could have full control.

 

Windows 2003 Share Permissions

 

Windows 2000/2003 NTFS and Share Permissions

 

no worries - im not fussed either way

 

wonder if he used FF or IE to access the wisesoft website ?

[IGB]

Well, that's pretty but no use. To make it do something "real" you change that echo to something meaningful:

E:
cd \Users\Students\Work\Intake07\ 
for /d %i in (*) do cacls %i /e /t /g %i:c

this will give you a series of commands and because your username matches the folder name it will work - eg you'll get

!

 

That scripts works brilliantly.

I've had to move home directories and roaming profile directories in order to upgrade one of our servers and used this script this morning.

 

We are currently running a mixed environment of Win XP & Win 7, so the roaming profiles actually create folders with a trailing .V2 for the Win 7 profiles.

 

Now of course the script can't find the user "user.name.V2" as they don't exist, so could anyone tell me how to omit the ".V2" from the variable "%%i" so that it will find the correct AD object to apply permissions.

 

Many thanks in advance.

 

Ian