Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On Windows Server 2008, is there an easy way to modify security permissions for multiple files at once (as with Windows Server 2003)? Right-click menu -> properties does not provide a "Security" tab if more than one file/directory is selected (i.e. ctrl-click multiple files).

Is there really a valid security reason for changing this in Windows Server 2008?

share|improve this question
1  
oh no! how will I fix all my security issues now, if i can't make all the files on my drive everyone full control! –  Nick Kavadias Jul 15 '09 at 6:32
    
I had a client once that literally did that. Erk. –  Ted Aug 4 '09 at 23:57

3 Answers 3

up vote 0 down vote accepted

Apparently it was purposely removed, according to this thread in the Server forums: http://social.technet.microsoft.com/Forums/en/winserverfiles/thread/dbfa011b-7c27-4e1d-b1a4-f0f8839b2d46

I understand that enabling administrator to set NTFS Security permissions across multiple folders would be a good feture. However, based on our experience, there are a number of users accidently mess up ACLs on massive selection files and folders. In Windows vista and Windows server 2008, To preventing this from occuring, it was designed to remove the Securtiy tab when multi-selection on folders. Currently, you can use icacls to grant NTFS permission on massive folders and files. Sorry for the inconvienence to you.

Meanwhile, I will forward your feedback to our product team to see if they will have a replacement of this functionality in the future.

Thanks for your understanding.

Needless to say, this response has been greeted with derision by various others in that thread. Now maybe Nick's comment to the question basically highlights Microsoft's rationale, but tbh it's a pain in the neck for those admins that do know what they're doing...

A workaround (also described in the thread) is to access the server from a 2k3 or XP client, then permissions can still be modified directly through the GUI.

share|improve this answer

I don't know if there's a trick to do it with the gui but i think the Icacls command is what you're after.

share|improve this answer
    
I've checked out various cmd line options (or will check them out further) but I'd like the "trick" with the GUI ;-) to do a what was in Win2003. –  Ted Jun 26 '09 at 15:44

Zow-- It looks like they've changed the behaviour from Windows XP! You used to be able to select multiple files and see a security tab, or select multiple folders and see a security tab. Selecting both, in XP, resulted in no security tab being displayed. I'm seeing a behaviour where I can't get a security tab with any combination of multiple files, folders, or both seleted on a Windows 7 machine. Ouch! What a misfeature.

Your best bet is probably going to be to use a command-line permission utility like SetACL ( http://setacl.sourceforge.net/), CACLS (built-in to Windows), or XCACLS (http://www.microsoft.com/downloads/details.aspx?familyid=0ad33a24-0616-473c-b103-c35bc2820bda).

re: the "valid security reason" - Setting file permissions to what you need is a "valid" use of an operating system feature. A server OS w/o configurable file system permissions would be a pretty crappy server OS. (grin)

share|improve this answer
    
Thanks for the answer. But of course, my "is there a reason" is "why did they change it from Win2003 where you could select multiple files etc. and change all of them at once", not "why would you need ACLs ;-) –  Ted Jun 26 '09 at 14:42
    
I understand your inquiry now. Your phrasing confused me. I can't tell you why they changed it. Considering it was a valuable and useful feature, I'm chalking this up to yet one more way in which it appears that Microsoft doesn't actually use their own products in the same way that we do. –  Evan Anderson Jun 26 '09 at 17:05

protected by Mark Henderson Jun 23 '11 at 4:11

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.