security rights propogation issue...

[Brad Pears]

I have a root directory and many individual directories for each user
underneath that. The individual user's directories have permissions set to
themselves and administrator - no one else.

I want to add a particular user to each of the directories - and give that
user "full" access. I do not want to add the user to the admins group - I
just want this particular user to have access to these dirs.

If I enter the user in the root dir, set the permissions for him, click on
'advanced' tab and then check the 'reset permissions etc..' check box, all
permissions will be reset on each of the undividual user dirs - I do not
want this.

Is there a way to enter the user in the root dir, but have the security
propogation 'add' to the existing security for each sub-dir NOT replace the
security on each sub dir??

Thanks,

Brad

 

[Pegasus]

I have a root directory and many individual directories for each user
underneath that. The individual user's directories have permissions set to
themselves and administrator - no one else.

I want to add a particular user to each of the directories - and give that
user "full" access. I do not want to add the user to the admins group - I
just want this particular user to have access to these dirs.

If I enter the user in the root dir, set the permissions for him, click on
'advanced' tab and then check the 'reset permissions etc..' check box, all
permissions will be reset on each of the undividual user dirs - I do not
want this.

Is there a way to enter the user in the root dir, but have the security
propogation 'add' to the existing security for each sub-dir NOT replace the
security on each sub dir??

Thanks,

Brad

Try this batch file:

@echo off
cacls d:\UserFolders /e /t /g SomeUser:F

This will add SomeUser to d:\UserFolders and every folder underneath,
without disturbing the existing permissions.

 

[Brad Pears]

Excellent. I'll give that a shot...

Try this batch file:

@echo off
cacls d:\UserFolders /e /t /g SomeUser:F

This will add SomeUser to d:\UserFolders and every folder underneath,
without disturbing the existing permissions.

 

[Brad Pears]

Do you know if this same command can be used to grant/revoke group security
as opposed to individual user names? It works great for usernames but if I
try to use a group name, I get the folowing error...

"No mapping between account names and security IDs was done".

Maybe I just need the proper syntax or maybe there is a different command?

Thanks,

Brad

 

[Brad Pears]

Works like a top. I even found out how to apply group rights as well as
individual users!! It is an undocumented feature where you place the group
name in quotes i.e.

cacls d:\data\userdata /e /t /c /g "Domain Admins":F

(you probably already knew that though...)

Thanks for that.

 

[Pegasus]

This is not at all an "undocumented" feature, and it has nothing
to do with group names - it is a standard throughout Windows:
When a file name, user name, group name or share name
contains an embedded space then you must enclose it in
double quotes.

 

[Brad Pears]

Oh, I found a micorosft document that referred to it as "undocumented CACLS:
Group Permissions Capabilities"

Check this out...

http://support.microsoft.com/default.aspx?scid=kb;EN-US;162786

 

[Pegasus]

The article you refer to says that the standard documentation omitted
the "Group" feature. However, your problem appears to have been
caused by embedded spaces. Adding the double quotes fixes the
problem, both for users and for groups!