-1

The following is my bat file. Is there a way I can substitute First.Last with usernames from a CSV file? My boss doesn't want to do all the users at once. He's afraid that something may happen so he's handpicking 10-20 people every night.

echo Y | takeown /F "F:\Users\First.Last" /R
icacls "F:\USERS\First.Last" /reset /T /C /Q
icacls "F:\USERS\First.Last" /inheritance:r /T /C /Q
icacls "F:\USERS\First.Last" /grant:r system:(oi)(ci)f /t /c /Q
icacls "F:\USERS\First.Last" /grant:r "Site admins":(oi)(ci)f /t /c /Q
icacls "F:\USERS\First.Last" /grant:r "Domain admins":(oi)(ci)f /t /c /Q
icacls "F:\USERS\First.Last" /grant:r "CREATOR OWNER":(OI)(CI)F /T /C /Q
icacls "F:\USERS\First.Last" /grant:r First.Last:(oi)(ci)f /t /c /Q
icacls "F:\USERS\First.Last" /remove:g "everyone" /T /C /Q
icacls "F:\USERS\First.Last" /remove:g "administrators" /T /C /Q
icacls "F:\USERS\First.Last" /remove Everyone /T /C /Q
icacls "F:\USERS\First.Last" /remove:g "Example\administrator.account" /T /C /Q
icacls "F:\USERS\First.Last" /remove "Example\administrator.account" /T /C /Q
icacls "F:\Users\First.Last" /setowner "Example\First.Last" /c /t /Q
icacls "F:\USERS\First.Last" /inheritance:e /T /C /Q
net share First.Last$ /delete
icacls "F:\USERS\First.Last" /remove:g "system" /T /C /Q
icacls "F:\USERS\First.Last" /remove "system" /T /C /Q
icacls "F:\USERS\First.Last" /remove:g "Site Admins" /T /C /Q
icacls "F:\USERS\First.Last" /remove "Site Admins" /T /C /Q
icacls "F:\USERS\First.Last" /remove:g "Domain Admins" /T /C /Q
icacls "F:\USERS\First.Last" /remove "Domain Admins" /T /C /Q
icacls "F:\USERS\First.Last" /remove:g "Creator Owner" /T /C /Q
icacls "F:\USERS\First.Last" /remove "Creator Owner" /T /C /Q

The last few lines, we are removing explicit permissions from the Username folder. What are best practices? The "Site Admins, Domain Admins, Creator Owner" are on the top level folder so every sub-folder (username) will get these permissions.

Is it better to leave the permissions (explicit) for each username? If so then why? Or should I rely on inherited permissions? (if so then why)?

Improve this question
1
  • It really depends on what you want to achieve and no one can answer that question in general. Keep in mind that explicit permissions ALWAYS overwrite inherited permissions so if you even DENY a user permissions on a top-level-folder when you permit e.g. reading for this user on a subfolder he will have read access. Regarding user accounts you normally would want to remove everyone except the user, administrators and system from each user account. And normally you can remove the "Creator Owner" group completely. It's not useful for user folders, just for e.g. seldom used "drop folders".
    – Broco
    Aug 15, 2014 at 18:15

1 Answer 1

Reset to default
1

Concerning your Powershell snipplet: It's exactly what you are looking for as long as the .csv has the information in exact the format you need. This means First.Last without quoting and without any other chars than the "." between First and Last and of course without column names.

To your second question: This depends on the setup you have and the things you want to achieve but in most cases you want to have the default behaviour because if you set explicit permissions wrong you will have a bunch of problems.

Improve this answer
3
  • Thanks. I am not an expert in PowerShell but I wanted to verify it worked before deploying to a live environment. Does the script need to be run from the server? Can I run it from another machine (change the path to \\server\users\username)??
    – GettingStarted
    Aug 14, 2014 at 12:46
  • As long as you are logged in as an administrative user with full permissions on the directories you can run the script from any computer in the Domain, that shouldn't be a problem.
    – Broco
    Aug 14, 2014 at 13:13
  • edited question
    – GettingStarted
    Aug 15, 2014 at 16:38

Not the answer you're looking for? Browse other questions tagged .