Permissions Issue

[markesmith]

Hi

Server2003/XP

I'm trying to run the following two lines in a batch file at the students' logon......

 

Cacls C:\ /e /g "studentgroup":r

net time \\SERVER /set /yes

 

I've stuck it in Netlogon and it runs but come up with an Access is denied error and the net time command says 'A required priviledge in not held by the client'.

 

It works fine for staff.

 

I realise it's a permissions issue in that the students haven't got permissions to alter their priviliges to the local C: drive but I'm not quite sure how to get round it (other than to go round and log in each computer with a staff account!). Many thanks.

[DrPerceptron]

You might be able to get around it using the runas /user: switch and specifying a password...

 

Why would you want to do this though out of interest? Surely there are other ways of going about what you intend to achieve?

[azrael78]

Cacls C:\ /e /g "studentgroup":r

 

*cringe*

 

Not wanting to sound like an arse here but why would you want to grant the students any kind of extra permission to C:?

 

In any case - if you want this to run at logon you have a few options...

 

1) Group Policy - You can use Group Policies to assign local security rights over files and folders, this would be far quicker and easier than a local script.

 

2) As already mentioned - RunAs - There are versions of RunAs that can take an admin login and password and run your command as an administrator, but these are unsecure at the best of times.

 

3) Create an AutoIT script to do this change, package it to run as an administrator - This is a good idea but only if you know AutoIT or can learn enough to just do what you want.

 

The best idea is to use Group Policy if you have to grant them the rights, if you can't do that - then I'd seriously look at #3 long before I would look at #2.

 

HTH,

 

Az

[maniac]

How about running it as a machine startup script insted of a logon script? Startup scripts run under the local system account, and can modify permissions on any files on the C:\

 

Also insted of using the CACLS executable, I tend to use the VBS version of XCACLS if I'm changing file permissions using scripts, I find it more reliable.

 

Mike.