Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a simple script I can use to give a destination folder and the AD group I want to use and it would generate a set of folders with the members of that AD group and delegate the proper permissions to those folders?

I have gotten as far as dsget group "FQN" -members and it returns a list of FQN's.

Here is an example of what I am looking for...


Root Folder - has permission for SomeADGroup (already set up)
    member1 - member1 has modify; other SomeADGroup members, no permissions
    member2 - member2 has modify; other SomeADGroup members, no permissions
    memberN - memberN has modify; other SomeADGroup members, no permissions
share|improve this question
Are you trying to set up roaming profiles or redirected folders? If so, there is a better way! – Jay Michaud Jun 30 '09 at 14:59
@Jay - no not at this time. – Daniel A. White Jun 30 '09 at 14:59
@Jay: Letting the OS create them is, IMHO, not a better way, but we can have that discussion some other time... smile – Evan Anderson Jun 30 '09 at 15:07
@Evan - does that make sense? – Daniel A. White Jun 30 '09 at 15:10
@Daniel - Yeah. I wrote something quick and dirty to do what you need. It works fine on my test PC. – Evan Anderson Jun 30 '09 at 15:27
up vote 1 down vote accepted

Here-- have at.

Option Explicit

' DOMAIN\Group to process
Const GROUP = "Human Resources Department"

' Destination path - Do not append a "\"

' Constants for the NameTranslate object.
Const ADS_NAME_TYPE_1779 = 1

Dim objNameTranslate, objGroup, strUser, objShell

Set objNameTranslate = CreateObject("NameTranslate")
objNameTranslate.Init ADS_NAME_INITTYPE_GC, ""
objNameTranslate.Set ADS_NAME_TYPE_NT4, DOMAIN & "\" & GROUP
Set objGroup = GetObject("LDAP://" & Replace(objNameTranslate.Get(ADS_NAME_TYPE_1779), "/", "\/")) 

set objShell = CreateObject("Wscript.Shell")

For Each strUser in objGroup.Members
    objShell.Run "%COMSPEC% /c mkdir " & DESTINATION_PATH & "\" & strUser.samAccountName
    objShell.Run "CACLS " & DESTINATION_PATH & "\" & strUser.samAccountName & " /E /G " & DOMAIN & "\" & strUser.samAccountName & ":F"
Next ' strUser

A quick tour:

Set the DOMAIN, GROUP, and DESTINATION_PATH. Obviously, you'll have to be logged-on as a user with rights to make directories and set permission under the DESTINATION_PATH when you run this.

I could've probably done this more efficient in PowerShell, except that I can't stand PowerShell and haven't wanted to be bothered to get more in-depth with it. >smile< Likewise, I could've probably done the directory-making with the FileSystemObject, but this was faster for me to write. I could've done something fancier instead of the CACLS but, hey, it works.

share|improve this answer
This doesn't quite work - since we have a separate LDAP service aswell. Here is the error. Line: 19 Char: 1 Error: Name translation: Could not find the name or insufficient right to see name. Code: 80072116 Source: (null) – Daniel A. White Jun 30 '09 at 15:41
Wait-- you're talking about getting members out of a group on a non-AD LDAP server? No-- the NameTranslate object won't take care of the heavy lifting for me there. You could comment out line 19 and put the DN for the group in line 20 (i.e. GetObject("LDAP://--dn here--") as an example) and it might do what you want. Maybe. – Evan Anderson Jun 30 '09 at 15:48
Thanks a lot! I rewrote some areas and it works beautifully. – Daniel A. White Jun 30 '09 at 16:15

You can use powershell to do both. Depending on the size and depth of your folders it could take some recursion to get working.

You can create a folder simply

New-Item c:\scripts\Windows PowerShell -type directory

Then the easiest way to set permissions is probably using a if statements or something like that.

In powershell you use the two commandlets get-acl and set-acl to change permissions. So get the permission set from a predifined folder with the correct permissions, and set them to the folder you are working on.

Or define the permissions into a variable and just use set-acl depending on if you want the same permissions per folder.

Then use a couple of IF statements or soemthing to specify permissions based on folder name.

foreach ($file in $(Get-ChildItem $StartingDir -recurse)) {
  $acl=get-acl $file.FullName

  #Add this access rule to the ACL

  #Write the changes to the object
  set-acl $File.Fullname $acl
share|improve this answer
I'm trying to populate this from an active directory group. – Daniel A. White Jun 30 '09 at 15:23
You might need an AD snap in also. So you can use commands like Get-ADUser -group. Then have a statement that will create the folder with the same or similar name to the AD user. Then apply permissions with Set-Acl. – user10711 Jun 30 '09 at 16:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.