Search the Community

Hi All, ODD one. We use a 'route-map' to determine what to forward to our smooth wall cluster for filtering (or really the loadblancer). and this route-map refers to an ACL which defines if its a network we want to forward on or circumvent the smoothwalls. Up to date this has worked perfectly. However: as of a few days ago. Our ACL which contains an object-group (with a load of Microsoft Ip's in). Seems to only process down to the object group part of the ACL. Everything after that seems to be ignored. (or thats what the hit counters when viewing the ACL would appear to indicate along with Ip ranges suddenly not receiving transparent filtering) My question anyone has seen this before/know a fix? Thanks

Hello all, I'm currently planning our schools migration from an ancient flat network, to a segmented, VLAN network. We've just about settled on HP Procurves for our core and edge switches and I'm reasonably comfortable on getting the VLANS set up and routing configured, together with subnets etc. Im undecided on whether to use ACLs to secure our inter plan traffic or whether to use our existing Sophos UTM firewall to achieve similar results. Does anyone have specific experience of using Sophos UTMs to do this or is using ACLs a better option? Thanks in advance. Michael

Hi I'm going to go straight to the point, Now I've been aware of this problem for a while but surely there must be a way round it!!! but how I can set file permissions on multiple files / folders at one time. I have got to re organise a few shared folders with different permissions but I don't fancy spending hours on it when I know it can be done within minutes. I know I could do this with Windows server 2003 but since the release of 2008 they removed this. does anyone know how to get the security tab back when you highlight multiple folders or a program that will do the same job?? thanks

I am trying to simplify pulling directory ACLs. We have thousands of them and so I'd like to adjust this script I have so that it asks me what directory I'd like to check the ACLs for. Where it stands now the script must be edited manually when you run it on each machine. You have to change the directory name. So I'd like to turn the directory name in a variable and put the variable in the folder path. I appreciate the help as it will save so much time for me. It exports it to a .csv file where I can then import it into Excel and sort the tables accordingly. Here is what I have: powershell C:\GetDirectoryACls\GetDirectoryACLs.ps1 Get-childitem D:\Inetpub -recurse | where{$_.psiscontainer} | Get-Acl | % { $path = $_.Path $_.Access | % { New-Object PSObject -Property @{ Folder = $path.Replace("Microsoft.PowerShell.Core\FileSystem::","") Access = $_.FileSystemRights Control = $_.AccessControlType User = $_.IdentityReference Inheritance = $_.IsInherited } } } | ? {-not $_.Inheritance} | export-csv C:\GetDirectoryACLs\Get_Directory_ACLs_Output.csv -force

Hi, I just started experimenting with Skeep VNC console. It seems to work pretty well for our AD computers. I am trying to deploy it with MS logon II enabled for security. The problem is that when I configure it on the console and then deploy, the ACL settings are not transferring to the client. It installs and starts the service but there is nothing under the "Configure MS logon groups" and it won't connect. If I configure that manually at the client, it works. I only need one domain admin group for all the PCs in the OU. Is there a way I can set the ACL under group policy? Thanks for the help, Walt

I need to change the group owner to "07, 06" etc.... wbinfo -g | grep 07 07 07 exists from winbind ! setfacl -R -m group:"07":r-x ./07 getfacl 07 # file: 07 # owner: root # group: domain\040admins user::rwx group::r-x group:lp:r-x group:teachers:rwx group:support\040staff:rwx mask::rwx other::--- It doesn't change the group to "07" - instead it changes it to lp (lineprinter) group. Same with 03,04,05,06 respectively. grep lp /etc/passwd lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin ha - group 7. I can see its' obviously picking up the unix groups, not the windows ones. It DOES work for other windows groups (teachers, support staff, domain admins as above) I tried deleting the winbind cache, restarting winbind etc.. any ideas? It seems to be a new phenomena. TIA

Hi Im finding something really hard to get my head around regarding ACL on my share folder Basically im setting a mapped drive from a share, now ive got my users in a Global group and got my ACL group setup as Domain Local group, so as you can imagine i place my global users within the domain local group for the share so they can save work to the mapped drive! its all works. but i dont want them to see file permissions when they right click on a file or folder. (petty i know) but im sure it can be done. so far the only permissions set are administrators and system group full control and my ACL domain local group only has Traverse Folder / Execute File List Folder / Read Data Read Attributes Read Extended Attributes Create Files / Write data Create Folders / Append Data Write Attibutes Write Extended Attributes Delete there is no where in the ACL of the drive have i set Read Permissions Change Permissions for the ACL Domain Local group for my users. not even on the root of the drive. so when i goto login as a user they can access the drive. create files and folders this is fine and delete is fine too. but if i right click on the any file or folder i can read permissions if i create a folder or file directly from the share on the server under administrator. i got back to the client computer and log in as a users and it denies me to read permissions. which is what i want it seems that if a users creates a file or folder they can read permissions but if its created by administrator on the server they cant! ive even checked on the effective permissions and the Read Permission Change Permission are ticked but i cant see where it is inheriting this from! am i missing something here? HELP! BTW my share permission is set to change and not full control for the users thanks

Good morning all, We are currently in the process of replacing our wireless, and going from a Ruckus management wireless network to a Unifi, as it was a third of the price. I have done most of the setup but looking at setting up ACLs to block particular port traffic between different VLANs. On a Ruckus controller this is all built-in and easy to use, but unsure as to whether this is possible on a Unifi Cloud Key 2. Could anyone advice on this, as I have tried using the 'Firewall and security' section, but it doesn't do anything? Looking online, I have a feeling you need a dream machine or secure gateway to use the firewall features, but any help would be great? Worse case scenario I guess I will have to attempt this on our core switch. Many thanks

I have a new NAS that is AD aware. I'm trying to get GPOP to create a folder within a share for the individual user. I've given the test users group, traverse & list permissions. I've manually created a folder with read write permissions for just the testpupil1 and that worked a treat. Now I need GPO to create a folder with the individual read write permissions for just that user automatically. When GPO Preferences creates a folder what user is it using? The logged in user, or some system account? is this even the right approach? cheers. as my first test failed, access denied using the gpop create folder, I didn't use the users security context.

I am trying to run a powershell script to delete old user profiles, but the script only deleted a few profiles and when i go into C:\users\ and select a profile it says that i don't have access.. I want to run this script as part of a Shutdown/Logoff GPO , so any help would be appreciated.

Hi All, I’d like to know what is the best practice of editing and managing CISCO switch and router access control list (ACL)? I’m now connecting using the blue console cable into the device and then use putty to connect to the console COM1. 1. I enable logging then “show run” 2. Keeps pressing the keyboard to go ahead the “- - more- - “ delimiter 3. Open Notepad then edit the log to remove the “- - more - - “ keyword 4. Make necessary changes 5. Quickly Select 15 lines then Copy paste into the conf-t prompt (to reduce the input buffer limit and avoid timeout) 6. Make sure that there is no spacing or copy paste error in the step above then “write mem”. I wonder if there is a smarter or safest way in doing this to manage large scale network because copy pasting hundreds of line and verifying it one by one through putty and pressing the keyboard is too cumbersome. Any kind of help would be greatly appreciated. Thanks, AWT

Hi, I have an HP Procurve 5412zl switch that I want to add the following ACL's on as we have having issues with Meraki SM communicating with our ios devices and Meraki suggest the we add the following to our ACL: Destination_IP: 50.115.86.96/27, 185.17.255.128/25, 185.92.120.0/25, 217.89.128.0/24 Ports: 993 Protocol: TCP Direction: outbound Destination_IP: 50.115.86.96/27, 185.17.255.128/25, 185.92.120.0/25, 217.89.128.0/24 Ports: 60000-61000 TCP outbound Destination_IP: 17.0.0.0/8 Ports: 443, 2195-2196, 5223 TCP outbound Destination_IP: Any Ports: 5228-5230 TCP outbound Destination_IP: Any Ports: 80, 443 TCP outbound HP 5412zl does not have a gui for configuration of ACLs. At least not through the web interface. So I need to be able to do it from command line. Thanks