Controlling ACE for a file from a script

[Thomas Iwang]

Hi folks
I have a problem - I am trying to create an vbs
script which can modify the DACL for an given file - but I
am not sure how to do - can somebody help?? Icannot use
cacls.exe because I need to set permissions for a file
some special users like NT Authority\SYSTEM - and this
gives me a little challange.
What I need is a simple script (just a sample) which shows
how to remove the ACE from a DACL for BUILTIN\Users and
setting the permission for the virtual NT AUTHORITY
account SYSTEM to Read & Write on an given file dummy.txt.
Hast somebody an sample I can reuse for my purpose ??

Kind regards
Thomas Iwang

 

[Ritchie]

What I need is a simple script (just a sample) which shows
how to remove the ACE from a DACL for BUILTIN\Users and
setting the permission for the virtual NT AUTHORITY
account SYSTEM to Read & Write on an given file dummy.txt.
Hast somebody an sample I can reuse for my purpose ??

Take a look at SetACL: http://setacl.sourceforge.net/

 

[Herb Martin]

Ritchie is correct, SetAcl can pretty much do anything with permissions
but it is extremely tedious to learn how to use.

XCacls (ResKit) works basically like Cacls only with more features and
control.

 

[Guest]

Hi folks

Thanks for the idea - but - I have to do it from WSH
through the Win32 mgmts interface because these
application refuse to accept "NT Authority\System" as an
account to assign permissions to - which gives some sort
of sense since this account doesn't exist as an user. If
you download the DLL ADsSecurity.dll you have the
possibility to add the needed permissions - but - I have
to distribute this script to ~ 50 servers (none of them
are locale) run it as an batch-job and cross my fingers
that nothing went wrong. That DLL also has to be
distributed then and until now the only thing I have seen
install and run automatically without problems are mostly
know as a virus.
So I would prefer to do it directly from Win32-managment
without that DLL - anyone out there ever tried to do
this ??

Kind regards
Thomas Iwang

 

[Rudy Seoa]

Hi folks

Thanks for the idea - but - I have to do it from WSH
through the Win32 mgmts interface because these
application refuse to accept "NT Authority\System" as an

Just use "SYSTEM" instead of "NT Authority\System"

 

[Thomas Iwang]

hi
You are right - it workjs - thanks
kind regards - ti

 

[Dale]

Ritchie is correct, SetAcl can pretty much do anything with permissions
but it is extremely tedious to learn how to use.

XCacls (ResKit) works basically like Cacls only with more features and
control.

WAIT! Xcacls.exe from the reskit does not work under CP/2000 because it
does not understand inheritance. Use xcacls.vbs and you will be okay, but
then you need to understand a lot about scripting. My vote is for
SETACL.EXE

 

[Herb Martin]

WAIT! Xcacls.exe from the reskit does not work under CP/2000 because it

does not understand inheritance. Use xcacls.vbs and you will be okay, but
then you need to understand a lot about scripting. My vote is for
SETACL.EXE

I don't understand your post (or it is incorrect) because I use XCopy on
Win2000
(and NT, XP, 2003) regularly.

Again, SetAcl will do most anything regarding permissions but it is very
tedious
to use, even for command line gurus.