Could anyone explain this behaviour to me?

[fafster]

I needed to change the permissions of a folder on a number of machines to enable write access by pupils and staff.

 

If I run the command:

 

psexec @"c:\computers.txt" cacls "c:\Program Files\Application" /E /T /C

/G Users:F

 

It loops through all the computers and returns "with error code 2" for each machine, cannot find the file specified.

 

But if I run the following command:

 

for /F %A in (c:\computers.txt) do psexec \\%A cacls "c:\Program Files\Application" /E /T /C /G Users:F

 

It completes the task without issue.

 

The computers.txt file is the same in both instances. It just seems strange that I have to circumvent the built-in functionality.

 

This is more of a head-scratcher than anything so I was wondering if anyone could explain to me the reason for this.

[BJG]

I think you need:

 

psexec @c:\computers.txt

 

...without the quotes. (Sounds illogical, but give it a try.)

Edited December 14, 2010 by BJG

[sted]

why not use group policy settings to set the permissions?

[fafster]

I think you need:

 

psexec @c:\computers.txt

 

...without the quotes. (Sounds illogical, but give it a try.)

 

Cheers for that. It didn't occur to me to remove the quotes as it was picking up the machine names and looping through them.

 

Thinking straight is a lot harder with a cold....

[fafster]

why not use group policy settings to set the permissions?

 

I didn't realise you could set NTFS permissions with group policy. Care to show me how?

[Jon]

Computer Configuration - Windows Settings - File System:- Right click - add file.

 

You can set file and folder security from here.

[featured_spectre]

Jon is right, but be warned as it applies to all machines globally within the policy, not just a select few within an OU.

[fafster]

Computer Configuration - Windows Settings - File System:- Right click - add file.

 

You can set file and folder security from here.

 

The DC is 2003. Is there an ADM that I can download to enable this functionality?

[Jon]

You don't need an ADM, this policy is native to a 2003 AD group policy

[fafster]

You don't need an ADM, this policy is native to a 2003 AD group policy

 

It's under security settings. For the life of me I just could not see it.

 

I couldn't find my car keys this morning, either, so I don't think there's much hope for me.