chkdks / resetting security

[BM]

Hi,

This is actually a 2003 server, but I cant find the newsgroup. Assume its
the same as 2000 anyway.

I'm implementing a new file server, and have been sorting out the permission
for user directories, departments etc etc. I ran a checkdsk on the volume,
this ran, and replaced "invalid security id with default security id" for
about 600,000 files. What exactly does it determine as "invalid security"?
It was working fine until I ran check disk. Obviously the default security
is rather locked down, and denies all my users from accessing their files.
After a few hours of messing, I eventually sorted it (that and I had a
script to do half the work anyway). The script just sets the owner of files
in their user directory (using subinacl), and gives them full control to
anythgin in their user directory. If its relevant I can copy the code.

I've just run another chkdsk (without /f!!) and its come up with a load more
"invalid security IDs", though there didnts seem to be as many files as last
time

what doesn't it like??

Does anyone know of any program that can 'back up' the security settings on
files so that if this happens again - presumably when i next chkdsk /f, I
can just restore them?

Thanks
Barry

 

[Steven L Umbach]

I found a KB link that describes your problem but for Windows 2000. I could
not find one for Windows 2003. There are no specific Windows 2003 newsgroups
as now the "server" newsgroups can be used for such. You may want to post in
the general server newsgroup. A full backup/image would probably be your
best bet to recover ntfs permissions. --- Steve

http://support.microsoft.com/?kbid=873437

 

[BM]

Does anyone know of any program that can 'back up' the security settings
on files so that if this happens again - presumably when i next chkdsk /f,
I can just restore them?

Thanks
Barry

For anyone googling this later, you can use a command called "setacl" and
the rather commands shown here
http://setacl.sourceforge.net/html/examples.html

 

[Steven L Umbach]

Thanks for that info. Fileacl may be another possibility with the /batch
switch. --- Steve