modifying NTFS permissions

[Guest]

Hi all

I have a windows 2003 server that is part of a NT domain. On this server are
users home fodler. There is a share on the server called "home" The share
permissions on this folder is domain users read access and the NTFS
permissions has the domain users group with the read and lsit folder contents
permissions. What i need to do is modify all the sub folders of the users
directory so that only the domain admins and the user account that matches
the folder name are listed in the NTFS permissions. All home folders match
the users NT account. Is there a tool that i can use that will allow me to
modify each sub direcotry so that only the domain admins and the user account
have full access. I tried using but the script did not run.
http://support.microsoft.com/Default.aspx?kbid=180464

Thanks

Skip

 

[Jerold Schulman]

Hi all

I have a windows 2003 server that is part of a NT domain. On this server are
users home fodler. There is a share on the server called "home" The share
permissions on this folder is domain users read access and the NTFS
permissions has the domain users group with the read and lsit folder contents
permissions. What i need to do is modify all the sub folders of the users
directory so that only the domain admins and the user account that matches
the folder name are listed in the NTFS permissions. All home folders match
the users NT account. Is there a tool that i can use that will allow me to
modify each sub direcotry so that only the domain admins and the user account
have full access. I tried using but the script did not run.
http://support.microsoft.com/Default.aspx?kbid=180464

Thanks

Skip

Set the share permissions to "Authenticated Users" Full Control.

Set the NTFS permission on for the "home" folder to Administrator and Creator Owner Full Control.
Propogate to all sub-folders.

Set each user as the owner of their own folder.
Use subInACL from tip 8530 in the 'Tips & Tricks' at http://www.jsiinc.com
Assume the local path to 'home" is c:\home

@echo off
setlocal
for /f "Tokens=*" %%a in ('dir c:\home /b /s /AD') do (
set folder=%%a
call :setowner
)
endlocal
goto :EOF
:setowner
for /f "Tokens=3 Delims=\" %%b in ('@echo %folder%') do (
subinacl /subdirectories "%folder%\*.*" /setowner="DomainName\%%b"
)



Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com