Server 2003 sp2 32bit (Folder/file permissions)

[trueblue64]

Need help, the server started acting daft. I work in a school, we have a shared folder on drive E for staff. within this folder all the staff have there own folders, and through profile the drive is mapped when they login.The permissions have gone tits up. I need it to work this way

 

1. Drive E has a shared folder call "homefolders"

2. Within this folder all the staff have there folders

 

Step 1+2 are present and correct

 

3. When the user logs on the drive is mapped (this works fine)

 

This is were it has gone tits up.

 

4. The user can open the folder read and write etc

5. If the user tries to open the "homefolders" folder it should say you don`t have the rights ( This at the moment is not happening they can open the folder)

6. If they try and open anyone else`s folder they should get the same error you dont have the rights (At the moment they can open, read and write to anybodies folder)

 

What I want is for user to be able to access there own folders, be able to read write etc. If they try and access the "homefolders" folder or anyone else`s folders they must be told they can`t. I have tried everything but can`t achieve this. Please help.....

Edited February 24, 2012 by trueblue64

[glennda]

aslong as the folder name is there username I have a script I can post up which will change all the permissions so that they are correct on the individual folders.

 

What they should have is (i'm fairly sure this is correct just going from the top of my head)

 

Share permissions - full control

NTFS -

root folder (i.e the one with all the folders in) Lists/read without propergation lower down. Then each folder underneath - User whos Documents Full Control - Domain Admins/Local Administrators group Full control.

[trueblue64]

Yes the folder name is the same as the login name ie folder 1122 username 1122

[glennda]

OK if you put this script into the folder you are wanting to change permissions on and save as a bat file

 

for /d %%1 in (*) do echo y|calcs %%1 /t /g %%1:f Administators:f "Domain Admins":f System:F

 

This explained - for each folder as %foldername% in (current folder) do this command | change permissions for %foldername% grant %foldername%:full control Administators:Full Control Domain Admins:Full Control System:full Control

 

If you want to modify this so that you grant a extra group read only permissions to the folders (such as teaching staff on kids documents) add

"Teaching Staff":r

to the end of the script

[trueblue64]

Thanks Glennda will try this Monday. Will the users of the folder still be able to read/write, also will they not be allowed to see the root folder of other peoples folders with this script. Edited February 25, 2012 by trueblue64

[trueblue64]

Ok script did not work, it says calcs is not a recognised command

[glennda]

Sorry my bad - typo its CACLS

[trueblue64]

Thanks Glennda, I get this when I run the command after every folder.

"No mapping between account names and security ID's was done"

Is this correct

[glennda]

no. Are you running the script from the directory in which the folders are located locally on the server? (should have mentioned!)

[trueblue64]

Thanks Glennda, I get this when I run the command after every folder.

"No mapping between account names and security ID's was done"

Is this correct

 

Yes I run the script in the homefolders folder, where all the teaching staff folders are. Do I have to run with power shell or normal command line

[glennda]

Normal Command line should work.