|
Posted by Lanwench [MVP - Exchange] on November 20, 2007, 9:28 am
Please log in for more thread options
> I've been playing with xacls.vbs a bit and I'm making progress. There
> are still some problems though. I created a new account and logged in
> in order to get a "template" of the permissions that are to be
> assigned to all the old folders. Here's the output from xacls.vbs:
>
> Allowed OURDOMAIN\test07ra Full Control This Folder
> Only
> Allowed NT AUTHORITY\SYSTEM Full Control This Folder
> Only
> Allowed BUILTIN\Administrators Full Control This Folder
> Only
> Allowed OURDOMAIN\test07ra Special (Unknown) Subfolders and
> Files
> Allowed NT AUTHORITY\SYSTEM Special (Unknown) Subfolders and
> Files
> Allowed BUILTIN\Administrators Special (Unknown) Subfolders and
> Files
>
> Here's the output for the same folder using fileacl's /ADVANCED
> switch:
>
> V:\Shared\Profile\test07ra;OURDOMAIN\test07ra:RrRaRepWwAWaWePXDDcO/U/U
> V:\Shared\Profile\test07ra;NT AUTHORITY\SYSTEM:RrRaRepWwAWaWePXDDcO/U/
> U
> V:\Shared\Profile\test07ra;BUILTIN\Administrators:RrRaRepWwAWaWePXDDcO/
> U/U
> V:\Shared\Profile\test07ra;OURDOMAIN\test07ra:U/F/F
> V:\Shared\Profile\test07ra;NT AUTHORITY\SYSTEM:U/F/F
> V:\Shared\Profile\test07ra;BUILTIN\Administrators:U/F/F
>
> In other words, when the profile folder is created upon first login,
> the above permissions are assigned to the folder. What does "Special
> (Unknown)" mean?
>
> What I'm desperately looking for is instructions on how to duplicate
> these exact permissions onto other folders. With test07ra replaced
> with the the respective usernames of course. I've tried fileacl's /
> BATCH switch, but it doesn't work as expected. This is what fileacl
> spits out for the test07ra folder when using the /BATCH switch:
>
> V:\Shared\Profile>fileacl.exe test07ra /BATCH /SUBS
> FILEACL V:\Shared\Profile\test07ra /INHERIT /REPLACE /SUB
> FILEACL V:\Shared\Profile\test07ra /S "CAMPUSHBG\test07ra":F/U/U /S
> "NT AUTHORITY\SYSTEM":F/U/U /S "BUILTIN\Administrators":F/U/U /S
> "CAMPUSHBG\test07ra":U/F/F /S "NT AUTHORITY\SYSTEM":U/F/F /S "BUILTIN
> \Administrators":U/F/F /REPLACE /PROTECT
>
> However, if I run these two commands on another folder, I end up with:
>
> V:\Shared\Profile>fileacl.exe test2 /ADVANCED
> V:\Shared\Profile\test2;BUILTIN\Administrators:U/RrRaRepWwAWaWePXDDcO/
> RrRaRepWwAWaWePXDDcO
> V:\Shared\Profile\test2;NT AUTHORITY\SYSTEM:U/RrRaRepWwAWaWePXDDcO/
> RrRaRepWwAWaWePXDDcO
> V:\Shared\Profile\test2;CAMPUSHBG\test2:U/RrRaRepWwAWaWePXDDcO/
> RrRaRepWwAWaWePXDDcO
>
> which is not the same as the folder from which I "copied" the
> permissions.
>
> I'm lost!
Note - I'm not a scripting guru either. And as much as I love command lines,
this particular sort of thing makes me nervous. Last time I did this, I used
the GUI in the link I originally posted for you - and *added* the group
Administrators, without changing anything else. Sorry I can't help further;
you might post in m.p.windows.server.scripting if you want to do this
without the little gui helper.
| 
XML Sitemap