jklight

If you come up with something please post back.

i just fixed this on a lab today. Checked application event log and it said permissions were wrong on a file that MS Visual Studio left behind. it was in the C:\users\default\ something something folder. so i wrote a script to do icacls \\computer\c$\users\default\whatever /reset /t /c /q and now no problem! Probably could have delete the file.

probably can do with dos for command like this: for /D %a in (\\server\users\yeargroup\) do icacls %a /grant itstaff:F I have used the script that follows in the past to fix problems. It querys AD first to select users you need fixing and the does the ICACLS work on their homedirectory taken from AD. REM reset users permissions REM @[u][url="http://www.edugeek.net/member.php?u=16971"]echo[/url][/u] off if {%1}=={} @[u][url="http://www.edugeek.net/member.php?u=16971"]echo[/url][/u] syntax: %0 Description&goto :EOF dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User)(description=%~1)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(homedirectory=*FILE-SERVER*))" -limit 500 | dsget user -hmdir -samid -c > out.txt for /f "skip=1 tokens=1,2" %%a in (out.txt) do call :resetp %%a %%b goto :EOF :resetp if /I %1 EQU dsget goto :EOF TAKEOWN /F %2 /R /D Y > NUL icacls %2 /reset /Q /T /C >>log.txt icacls %2 /setowner %1 /Q /T /C >>log.txt icacls %2 /grant:r administrators:(OI)(CI)(F) system:(OI)(CI)(F) %1:(F) "creator owner":(OI)(CI)(IO)(F) /Q /C >>log.txt

Rem uninstall old versions "%~dp0sw_uninstaller.exe" /s msiexec /uninstall "%~dp0sw_lic_full_installer.msi" /qn /norestart /l*v "%windir%\temp\shockwave_uninstall.log" REG DELETE HKCR\Installer\Products\388E33E771D079344A165B6706E5431B /f REG DELETE HKCR\Installer\Products\7C43C21609E58D74B9C5F017D78D7262 /f REG DELETE HKCR\Installer\Products\CB540FA28F8E71F40859861EE4CC32F4 /f SW_uninstaller.exe downloaded from Adobe sw_lic_full_installer.msi was latest (12.1.6) downloaded from Adobe

Sometimes i have resorted to adding this to the local logon script: cscript c:\windows\system32\prnmngr.vbs -t -p "Whatever Printer You Want Default"

Could you give more detail? Default printer is a user setting so it should stay set to whatever the users selects and survive reboots.

dsquery user ou=Students,dc=school,dc=net | dsmod user -hmdir \\srv1\share\$username$ -hmdrv H: Using DSMod to update Active Directory | CRMguru

One of the things delprof2 (Delprof2 - User Profile Deletion Tool) says it can do.

Section from my student account creation script that does the share and permissions: function createUserDirectory { #CREATE USER DIRECTORY try { $homeDir=$UsersDir+"\"+$User if (!(Test-Path -path $homeDir)) { New-Item $homeDir -type directory | Out-Null Set-ItemProperty $homeDir -name attributes -value ([system.IO.FileAttributes]::Hidden) } } catch [Exception] { write-host $_.Exception.ToString()+" "+$homeDir+$Logon+"ERROR 700"; ExitWithCode (700) } $LocalPath="M:\"+$School+"\students" $Sharename = $Logon+"$" $checkShare = Get-WmiObject Win32_Share -computername $HomeSrv -Filter "Name='$ShareName'" if ($checkShare -ne $null) { # "Share exists and will now be deleted!!!" write-host "Share exists and will now be deleted!!!"+$ShareName get-WmiObject Win32_Share -computername $HomeSrv -Filter "Name='$ShareName'" | foreach-object { $_.Delete() } | Out-Null } try { #share the new home directory $Class = "Win32_Share" $Method = "Create" $description = "Home drive for:"+$User $sd = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_SecurityDescriptor").CreateInstance() $ACE = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_ACE").CreateInstance() $Trustee = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_Trustee").CreateInstance() $Trustee.Name = "EVERYONE" $Trustee.Domain = $Null $Trustee.SID = @(1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0) $ace.AccessMask = 2032127 $ace.AceFlags = 3 $ace.AceType = 0 $ACE.Trustee = $Trustee $sd.DACL += $ACE.psObject.baseobject $mc = [WmiClass]"\\$HomeSrv\ROOT\CIMV2:$Class" $InParams = $mc.psbase.GetMethodParameters($Method) $InParams.Access = $sd $InParams.Description = $description $InParams.MaximumAllowed = 4 $InParams.Name = $Sharename $InParams.Password = $Null $InParams.Path = $LocalPath+"\"+$user $InParams.Type = [uint32]0 $R = $mc.PSBase.InvokeMethod($Method, $InParams, $Null) switch ($($R.ReturnValue)) { 0 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Success"; break} 2 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Access Denied" -foregroundcolor red -backgroundcolor yellow;break} 8 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Unknown Failure" -foregroundcolor red -backgroundcolor yellow;break} 9 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Name" -foregroundcolor red -backgroundcolor yellow;break} 10 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Level" -foregroundcolor red -backgroundcolor yellow;break} 21 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Parameter" -foregroundcolor red -backgroundcolor yellow;break} 22 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Duplicate Share" -foregroundcolor red -backgroundcolor yellow;break} 23 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Reedirected Path" -foregroundcolor red -backgroundcolor yellow;break} 24 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Unknown Device or Directory" -foregroundcolor red -backgroundcolor yellow;break} 25 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Network Name Not Found" -foregroundcolor red -backgroundcolor yellow;break} default {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:*** Unknown Error ***" -foregroundcolor red -backgroundcolor yellow;break} } } catch [Exception] { write-host $_.Exception.ToString()+$Logon+"$ "+$LocalPath+"\"+$user+"ERROR 800"; ExitWithCode (800) } try { # set access permissions $acl = Get-Acl $homeDir $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,Traverse,TakeOwnership", "ContainerInherit", "None", "Allow") $acl.AddAccessRule($rule) $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,TakeOwnership", "ObjectInherit", "InheritOnly ", "Allow") $acl.AddAccessRule($rule) $acl.SetOwner([system.Security.Principal.NTAccount] $Logon) Set-Acl $homeDir $acl } catch [Exception] { Start-Sleep -Seconds 60 # WAIT AND TRY AGAIN $acl = Get-Acl $homeDir $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,Traverse,TakeOwnership", "ContainerInherit", "None", "Allow") $acl.AddAccessRule($rule) $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,TakeOwnership", "ObjectInherit", "InheritOnly ", "Allow") $acl.AddAccessRule($rule) $acl.SetOwner([system.Security.Principal.NTAccount] $Logon) Set-Acl $homeDir $acl }

I would use the commands from the other thread i linked to. for /? to see lots of help and examples for the for command.

Please use icacls instead of the older and problematic cacls Icacls: The New and Improved Cacls? | Security content from Windows IT Pro also, see this thread http://www.edugeek.net/forums/scripts/131364-icacls.html

dsquery * domainroot -filter "(&(objectCategory=Person)(objectClass=User)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(homedirectory=*server1*))" -limit 500 | dsget user -hmdir -samid -c > out.txt for /f "skip=1 tokens=1,2" %%a in (out.txt) do copy \\server\share\file %%a\folder\file

Password Policy Windows server 2008 R2 added a feature called "fine-grained password policy" which is what i think you are looking for. It does not look straight forward to implement and I have not personally tried to implement. Good luck.

A bit of a mess but maybe you can get what you need out of it! #CREATE USER DIRECTORY try { $homeDir=$UsersDir+"\"+$User if (!(Test-Path -path $homeDir)) { New-Item $homeDir -type directory | Out-Null Set-ItemProperty $homeDir -name attributes -value ([system.IO.FileAttributes]::Hidden) } } catch [Exception] { write-host $_.Exception.ToString()+" "+$homeDir+$Logon+"ERROR 700"; ExitWithCode (700) } $LocalPath="M:\"+$School+"\students" $Sharename = $Logon+"$" $checkShare = Get-WmiObject Win32_Share -computername $HomeSrv -Filter "Name='$ShareName'" if ($checkShare -ne $null) { # "Share exists and will now be deleted!!!" write-host "Share exists and will now be deleted!!!"+$ShareName get-WmiObject Win32_Share -computername $HomeSrv -Filter "Name='$ShareName'" | foreach-object { $_.Delete() } | Out-Null } try { #share the new home directory $Class = "Win32_Share" $Method = "Create" $description = "Home drive for:"+$User $sd = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_SecurityDescriptor").CreateInstance() $ACE = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_ACE").CreateInstance() $Trustee = ([WMIClass] "\\$HomeSrv\root\cimv2:Win32_Trustee").CreateInstance() $Trustee.Name = "EVERYONE" $Trustee.Domain = $Null $Trustee.SID = @(1, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0) $ace.AccessMask = 2032127 $ace.AceFlags = 3 $ace.AceType = 0 $ACE.Trustee = $Trustee $sd.DACL += $ACE.psObject.baseobject $mc = [WmiClass]"\\$HomeSrv\ROOT\CIMV2:$Class" $InParams = $mc.psbase.GetMethodParameters($Method) $InParams.Access = $sd $InParams.Description = $description $InParams.MaximumAllowed = 4 $InParams.Name = $Sharename $InParams.Password = $Null $InParams.Path = $LocalPath+"\"+$user $InParams.Type = [uint32]0 $R = $mc.PSBase.InvokeMethod($Method, $InParams, $Null) switch ($($R.ReturnValue)) { 0 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Success"; break} 2 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Access Denied" -foregroundcolor red -backgroundcolor yellow;break} 8 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Unknown Failure" -foregroundcolor red -backgroundcolor yellow;break} 9 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Name" -foregroundcolor red -backgroundcolor yellow;break} 10 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Level" -foregroundcolor red -backgroundcolor yellow;break} 21 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Invalid Parameter" -foregroundcolor red -backgroundcolor yellow;break} 22 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Duplicate Share" -foregroundcolor red -backgroundcolor yellow;break} 23 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Reedirected Path" -foregroundcolor red -backgroundcolor yellow;break} 24 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Unknown Device or Directory" -foregroundcolor red -backgroundcolor yellow;break} 25 {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:Network Name Not Found" -foregroundcolor red -backgroundcolor yellow;break} default {Write-Host "Share:$Sharename Path:$LocalPath\$user Result:*** Unknown Error ***" -foregroundcolor red -backgroundcolor yellow;break} } } catch [Exception] { write-host $_.Exception.ToString()+$Logon+"$ "+$LocalPath+"\"+$user+"ERROR 800"; ExitWithCode (800) } try { # set access permissions $acl = Get-Acl $homeDir $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,Traverse,TakeOwnership", "ContainerInherit", "None", "Allow") $acl.AddAccessRule($rule) $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,TakeOwnership", "ObjectInherit", "InheritOnly ", "Allow") $acl.AddAccessRule($rule) $acl.SetOwner([system.Security.Principal.NTAccount] $Logon) Set-Acl $homeDir $acl } catch [Exception] { Start-Sleep -Seconds 60 # WAIT AND TRY AGAIN $acl = Get-Acl $homeDir $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,Traverse,TakeOwnership", "ContainerInherit", "None", "Allow") $acl.AddAccessRule($rule) $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($Logon,"ReadData,ReadAttributes,ReadExtendedAttributes,ReadPermissions,WriteData,AppendData,WriteAttributes,WriteExtendedAttributes,DeleteSubdirectoriesAndFiles,Delete,Synchronize,TakeOwnership", "ObjectInherit", "InheritOnly ", "Allow") $acl.AddAccessRule($rule) $acl.SetOwner([system.Security.Principal.NTAccount] $Logon) Set-Acl $homeDir $acl }

If i remember correctly, pinned items are stored in the registry (at least in XP) so you would need to pin what you want and then save the profile and then make it a mandatory profile.