Permissions Have Gone!

[OhDear]

Hi All,

 

We seem to have lost the permisons of work folders for some of our students, only Domain Admins have access not the user

 

Is there a script/command that will add the filename (the username) to the security of the folder and give them full control?

 

Thanks for your help, dont really want to go through hundreds of folders

[old_n07]

If you are windows based this powershell script will get a list of all folders in your users share and add the following permissions

 

Domain administrators - Full

Local Admins = Full

System = Full

User = Modify

 

Change the path and domain accordingly.

 

##  Script to set permisions on folders in a directory where 
##  folder name is same as users SAMAccounName

$path = "d:\users" #edit as necessary to reflect path where folders are located
$shortdom = "somedomain" #enter your domain name

#Variables
$FC = "FullControl"
$Mod = "Modify"
$domAdmin = $shortdom + "\domain admins"
$locadmin = "builtin\Administrators"
$sys = "NT Authority\System"

#Search directory for folders
$items = get-childitem -path $path

#For each item found
$items | ForEach-Object {

#only perform on directories
if ($_.mode -match "d"){ 
$folder = $path + "\" + $_
$user = $Shortdom + "\" + $_

           $acl = Get-Acl $folder
           if ($acl.AreAccessRulesProtected) { $acl.Access | % {$acl.purgeaccessrules($_.IdentityReference)} }
           else {
           		$isProtected = $true 
           		$preserveInheritance = $false
           		$acl.SetAccessRuleProtection($isProtected, $preserveInheritance) 
           	 }
                

#Set permissions routine                
           $inheritance=[system.Security.AccessControl.InheritanceFlags]"ContainerInherit,ObjectInherit"
           $propagation=[system.Security.AccessControl.PropagationFlags]::None
           $allowdeny=[system.Security.AccessControl.AccessControlType]::Allow            
           
           $account1 = $domadmin
           $rights1=[system.Security.AccessControl.FileSystemRights]::$FC
           $dirACE1=New-Object System.Security.AccessControl.FileSystemAccessRule ($account1,$rights1,$inheritance,$propagation,$allowdeny)
           $ACL.AddAccessRule($dirACE1)

           $account2 = $locadmin
           $rights2=[system.Security.AccessControl.FileSystemRights]::$FC
           $dirACE2=New-Object System.Security.AccessControl.FileSystemAccessRule ($account2,$rights2,$inheritance,$propagation,$allowdeny)
           $ACL.AddAccessRule($dirACE2)

           $account3 = $sys
           $rights3=[system.Security.AccessControl.FileSystemRights]::$FC
           $dirACE3=New-Object System.Security.AccessControl.FileSystemAccessRule ($account3,$rights3,$inheritance,$propagation,$allowdeny)
           $ACL.AddAccessRule($dirACE3)

           $account4 = $user
           $rights4=[system.Security.AccessControl.FileSystemRights]::$Mod
           $dirACE4=New-Object System.Security.AccessControl.FileSystemAccessRule ($account4,$rights4,$inheritance,$propagation,$allowdeny)
           $ACL.AddAccessRule($dirACE4)
           
           $acl.setowner([system.Security.Principal.NTAccount] “Administrators”) #Sets the folder owner


           Set-Acl -aclobject $ACL -Path $folder #write permissions to folder
           
}
}

Edited September 4, 2012 by old_n07

[apeman]

 

Is there a script/command that will add the filename (the username) to the security of the folder and give them full control?

 

You dont want to give your users full control

[ADMaster]

You dont want to give your users full control

 

Just curious, why would you not want this, something obvious I'm missing?

 

To the question, I like ntfsfix by wisesoft

NTFSFix

[old_n07]

Just curious, why would you not want this, something obvious I'm missing?

 

To the question, I like ntfsfix by wisesoft

NTFSFix

 

Because they can then take ownership of the directory and change the permissions to lock anybody else out of it then you have to go through the process of taking ownership yourself to get back in etc.

[Davit2005]

Because they can then take ownership of the directory and change the permissions to lock anybody else out of it then you have to go through the process of taking ownership yourself to get back in etc.

 

 

Unfortunately, some software notably serif, likes the user to have full control

You can allways set the users GPO to hide the permissions tab.

 

If you are on Server 2003 you can use the following, you can modify to give certain staff read access, Domain Admin Full access etc. just copy the syntax for the administrator replacing the permission value.

 

----------------------------------------------

echo off

setlocal

 

set folder=[FOLDER PATH]

set log=errorlog.txt

 

for /F "tokens=*" %%G in ('dir "%folder%" /A:D /B') do (

echo Y|cacls "%folder%\%%G" /T /C /G "%%G":F administrators:F > NUL 2>>"%log%"

subinacl /errorlog="%log%" /file "%folder%\%%G" /setowner="%%G" > NUL 2>&1

subinacl /errorlog="%log%" /subdirectories "%folder%\%%G\*" /setowner="%%G" > NUL 2>&1

)

 

--------------------------------

Anyone tell me how to stop getting the Big Grin instead of text.

Edited September 5, 2012 by Davit2005

[OhDear]

Thanks for all your replys, I ended up using ICACLS to sort them out. Worked a treat!