Mass setting NTFS permissions

[localzuk]

I wasn't sure whether I should post this a seperate topic or not but I did in the end.

 

I now have my server set up how I want. I have ~600 pupil folders which all have permissions set correctly except for the actual user/owner of the folder.

 

The folders are named the same as the username.

 

I am wondering if there is a quick way of changing the permissions on all the folders without having to go through each directory and add the user as a permitted user with their associated priviliges?

 

Otherwise, I shall be here for a while editing each folder.

 

Cheers

Tony

[apeo]

I think this has been covered before but my internet is playing up so i cant really search on the forum for it. Anyway you can use a script to set the permissions using cacls and/or xcacls.

[OutToLunch]

If you're happy enough on the command line, it should be a 2 minute job using CACLS and a FOR loop.

 

for /D %I in (*) do cacls blah

 

from a command prompt in the folder holding your pupil folders. The syntax for the cacls blah part will depend on exactly what you want to set...

 

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/cacls.mspx

 

HTH

[localzuk]

Ah, I've done it using c# now. Cheers anyway. Would anyone like me to post the code I used?

[ajbritton]

Very much so!

[localzuk]

Ok. Well here it is:

 

           string user = "";

           string path = "";

           DirectoryInfo[] dirs = new DirectoryInfo(".").GetDirectories();

           foreach(DirectoryInfo di in dirs){

               path = di.FullName;

               user = di.Name;

               try

               {

                   DirectorySecurity dirSec = Directory.GetAccessControl(path);

                   dirSec.AddAccessRule(new FileSystemAccessRule(@"sch4290\" + user, FileSystemRights.FullControl, AccessControlType.Allow));

                   Directory.SetAccessControl(path, dirSec);

                   System.Console.WriteLine("DIR: " + user + " permissions added");

               } catch(Exception e){

                   System.Console.WriteLine("Error: " + e.Message);

               }

           }

 

You need to use System.IO and System.Security.AccessControl for it to work.

 

To prepare for this, I reset all permissions on the folders so that the groups that could access them were set up before these were set. I might tidy it up at some point and make it a little neater.

 

It did the job though.

[localzuk]

Actually, it seems to have given the permissions to the top level but none of the files/folders within. I'll make a few changes and post the result here.

[localzuk]

Right, found the thing I needed to change.

 

From this

 

dirSec.AddAccessRule(new FileSystemAccessRule(@"sch4290\" + user, FileSystemRights.FullControl, AccessControlType.Allow));

 

to this

 

dirSec.AddAccessRule(new FileSystemAccessRule(@"sch4290\" + user, FileSystemRights.FullControl, InheritanceFlags.ObjectInherit | InheritanceFlags.ContainerInherit, PropagationFlags.InheritOnly, AccessControlType.Allow));

 

And now it gives the right permissions to all child leaf objects and container objects.

 

Oh, and remember - the share also has to have write permissions for the group which the users reside else all the files will come up as read only.