2

On Windows Server 2008, is there an easy way to modify security permissions for multiple files at once (as with Windows Server 2003)? Right-click menu -> properties does not provide a "Security" tab if more than one file/directory is selected (i.e. ctrl-click multiple files).

Is there really a valid security reason for changing this in Windows Server 2008?

2
  • 1
    oh no! how will I fix all my security issues now, if i can't make all the files on my drive everyone full control! Jul 15, 2009 at 6:32
  • I had a client once that literally did that. Erk.
    – Ted
    Aug 4, 2009 at 23:57

3 Answers 3

0

Apparently it was purposely removed, according to this thread in the Server forums: http://social.technet.microsoft.com/Forums/en/winserverfiles/thread/dbfa011b-7c27-4e1d-b1a4-f0f8839b2d46

I understand that enabling administrator to set NTFS Security permissions across multiple folders would be a good feture. However, based on our experience, there are a number of users accidently mess up ACLs on massive selection files and folders. In Windows vista and Windows server 2008, To preventing this from occuring, it was designed to remove the Securtiy tab when multi-selection on folders. Currently, you can use icacls to grant NTFS permission on massive folders and files. Sorry for the inconvienence to you.

Meanwhile, I will forward your feedback to our product team to see if they will have a replacement of this functionality in the future.

Thanks for your understanding.

Needless to say, this response has been greeted with derision by various others in that thread. Now maybe Nick's comment to the question basically highlights Microsoft's rationale, but tbh it's a pain in the neck for those admins that do know what they're doing...

A workaround (also described in the thread) is to access the server from a 2k3 or XP client, then permissions can still be modified directly through the GUI.

2

I don't know if there's a trick to do it with the gui but i think the Icacls command is what you're after.

1
  • I've checked out various cmd line options (or will check them out further) but I'd like the "trick" with the GUI ;-) to do a what was in Win2003.
    – Ted
    Jun 26, 2009 at 15:44
0

Zow-- It looks like they've changed the behaviour from Windows XP! You used to be able to select multiple files and see a security tab, or select multiple folders and see a security tab. Selecting both, in XP, resulted in no security tab being displayed. I'm seeing a behaviour where I can't get a security tab with any combination of multiple files, folders, or both seleted on a Windows 7 machine. Ouch! What a misfeature.

Your best bet is probably going to be to use a command-line permission utility like SetACL ( http://setacl.sourceforge.net/), CACLS (built-in to Windows), or XCACLS (http://www.microsoft.com/downloads/details.aspx?familyid=0ad33a24-0616-473c-b103-c35bc2820bda).

re: the "valid security reason" - Setting file permissions to what you need is a "valid" use of an operating system feature. A server OS w/o configurable file system permissions would be a pretty crappy server OS. (grin)

2
  • Thanks for the answer. But of course, my "is there a reason" is "why did they change it from Win2003 where you could select multiple files etc. and change all of them at once", not "why would you need ACLs ;-)
    – Ted
    Jun 26, 2009 at 14:42
  • I understand your inquiry now. Your phrasing confused me. I can't tell you why they changed it. Considering it was a valuable and useful feature, I'm chalking this up to yet one more way in which it appears that Microsoft doesn't actually use their own products in the same way that we do. Jun 26, 2009 at 17:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .