Windows 2008 file/folder access

Question

We just upgraded our domain to Windows 2008. I was hoping there is a way to give modify rights to all files/folders on the file server to a group. I know that the administrators group (domain admins, etc)has full access everywhere, but i do not want this group to be able to change security settings. Is there any way to accomplish this?

We would like to create a group, and give this group the ability to modify all files/folders on the network (all folders on the network have different security permissions) without giving placing them in any admin group.

thanks,

Answer 1

There's no "shortcut" way to do what you're looking for. You're going to locate all the roots of permission inheritance in your various folder hierarchies and apply the "New Group / Change" permission to those hierarchies.

I suppose somebody could write something to seek out all folders where inheritance is blocked and automatically apply this permission change but I'm not aware of any such tool off the top of my head.

Edit:

The script below will (in a very simplistic way, and probably not 100% reliably) locate the top of permission hierarchies using the icacls tool. Specify the starting directory on the command-line.

(The script is just looking for DACLs on files that have the SE_DACL_PROTECTED flag set, per http://msdn.microsoft.com/en-us/library/aa379570(v=vs.85).aspx).

@echo off
if "%~1"=="" goto end

SET TEMPFILE="%TEMP%\%RANDOM%.txt"

for /D %%i in ("%~1\*") do (
 icacls "%%i" /save %TEMPFILE% >NUL 2>NUL
 find "D:P" %TEMPFILE% >NUL 2>NUL
 if errorlevel 1 del %TEMPFILE%
 if exist %TEMPFILE% echo Top of permission hierarchy: %%i
 if exist %TEMPFILE% del %TEMPFILE%
 call "%0" "%%i"
)

:end

You could easily add a condition to alter the permissions on the directories you find or just output the list to a file then iterate over the file.