Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We just upgraded our domain to Windows 2008. I was hoping there is a way to give modify rights to all files/folders on the file server to a group. I know that the administrators group (domain admins, etc)has full access everywhere, but i do not want this group to be able to change security settings. Is there any way to accomplish this?

We would like to create a group, and give this group the ability to modify all files/folders on the network (all folders on the network have different security permissions) without giving placing them in any admin group.

thanks,

share|improve this question

1 Answer 1

There's no "shortcut" way to do what you're looking for. You're going to locate all the roots of permission inheritance in your various folder hierarchies and apply the "New Group / Change" permission to those hierarchies.

I suppose somebody could write something to seek out all folders where inheritance is blocked and automatically apply this permission change but I'm not aware of any such tool off the top of my head.

Edit:

The script below will (in a very simplistic way, and probably not 100% reliably) locate the top of permission hierarchies using the icacls tool. Specify the starting directory on the command-line.

(The script is just looking for DACLs on files that have the SE_DACL_PROTECTED flag set, per http://msdn.microsoft.com/en-us/library/aa379570(v=vs.85).aspx).

@echo off
if "%~1"=="" goto end

SET TEMPFILE="%TEMP%\%RANDOM%.txt"

for /D %%i in ("%~1\*") do (
 icacls "%%i" /save %TEMPFILE% >NUL 2>NUL
 find "D:P" %TEMPFILE% >NUL 2>NUL
 if errorlevel 1 del %TEMPFILE%
 if exist %TEMPFILE% echo Top of permission hierarchy: %%i
 if exist %TEMPFILE% del %TEMPFILE%
 call "%0" "%%i"
)

:end

You could easily add a condition to alter the permissions on the directories you find or just output the list to a file then iterate over the file.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.