Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I'm looking for some advice/guidance on my issue:

Our file server was originally setup incorrectly by providing permissions to individual users rather than than groups. Ive been in the process of redoing the permissions manually, but I'd prefer to fix it in a bulk fashion.

I have a list of directories and users that are allowed access.

Directory,Group,Rights    
\\server2\storage\REPORTS\*,Mgmt,Full Access
\\server2\storage\REPORTS\*,HR,Full Access
\\server2\storage\IT\*,Tech,Full Access
etc

So my plan was to write a batch file using a long list of cacls commands with my list of directories and groups.

Does this sound like a sound plan, or is there a much better method/tool to use?

PS- I notice some folders/files do not have the permissions for CREATOR OWNER and SYSTEM. Should I add these to my list as well?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

I think that's a very reasonable plan. Using icacls or cacls will work fine. I prefer icacls, personally, because it has a "richer" feature-set. You could use Helge Klein's SetACL tool, as well, but in this case I don't think it buys you anything different than the first two tools (because you're not using any of its advanced features to backup / restore permission hierarchies, replace SIDs, etc).

I don't go for "CREATOR OWNER" because, typically, I don't actually need or want that. Using it creates a lot of non-inherited ACL entries and I try to have as few non-inherited entries as possible. I do name "SYSTEM", typically, in every ACL. It's not strictly necessary but I do it as a matter of habit. (I consider a "base" ACL to be "SYSTEM / Full Control" and "Administrators / Full Control" and then I expand from there.)

share|improve this answer
    
I might check out setACL as well if it has backup/restore functionality, just in case I need a recovery :)Kevin thanks –  TheNoodle Oct 12 '11 at 16:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.