Bulk Directory Permissions

Question

So I'm looking for some advice/guidance on my issue:

Our file server was originally setup incorrectly by providing permissions to individual users rather than than groups. Ive been in the process of redoing the permissions manually, but I'd prefer to fix it in a bulk fashion.

I have a list of directories and users that are allowed access.

Directory,Group,Rights    
\\server2\storage\REPORTS\*,Mgmt,Full Access
\\server2\storage\REPORTS\*,HR,Full Access
\\server2\storage\IT\*,Tech,Full Access
etc

So my plan was to write a batch file using a long list of cacls commands with my list of directories and groups.

Does this sound like a sound plan, or is there a much better method/tool to use?

PS- I notice some folders/files do not have the permissions for CREATOR OWNER and SYSTEM. Should I add these to my list as well?

Answer 1

I think that's a very reasonable plan. Using icacls or cacls will work fine. I prefer icacls, personally, because it has a "richer" feature-set. You could use Helge Klein's SetACL tool, as well, but in this case I don't think it buys you anything different than the first two tools (because you're not using any of its advanced features to backup / restore permission hierarchies, replace SIDs, etc).

I don't go for "CREATOR OWNER" because, typically, I don't actually need or want that. Using it creates a lot of non-inherited ACL entries and I try to have as few non-inherited entries as possible. I do name "SYSTEM", typically, in every ACL. It's not strictly necessary but I do it as a matter of habit. (I consider a "base" ACL to be "SYSTEM / Full Control" and "Administrators / Full Control" and then I expand from there.)