Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Has anyone used a script to reset the permissions on a directory of Home Directories? I'm thinking some combination of FOR loops and CACLS to add an inheritable Modify permission to a folder using the same domain username as the folder name.

We're migrating user shares from one server to another and the existing shares do not all have the proper permissions set. I'm considering copying all the folders without copying permissions and then resetting the permissions via script so that only the username that matches the folder has access. I can then re-apply any additional permissions needed for users having access to another users' folder.

share|improve this question
up vote 5 down vote accepted

Assuming you're running this on Windows Server 2003 or newer you'll have both the TAKEOWN and ICACLS commands. I'm also assuming the that top level folder permission is set sanely (i.e. "Authenticated Users - List Folder Contents - This folder only", proper "Administrator" permissions if you like them being able to get into user folders, etc).

@echo off
FOR /D %%i in (*) do (
  TAKEOWN /f "%%i" /r /d y
  ICACLS "%%i" /reset /T
  ICACLS "%%i" /grant:r "DOMAIN\%%i":(OI)(CI)F
  rem Unremark this line to set the owner to the user, if you like that
  rem ICACLS "%%i" /setowner "DOMAIN\%%i" /T

That'll take ownership, clean up all the permissions and restore inheritance, add the user w/ Full Control rights to the directory, and then optionally give back ownership if you un-rem the last line.

My condolences for having to deal with users sharing files between each other out of home directories. That's a real pain.

share|improve this answer
Accepting this because it is complete and covers all scenarios – Kevin Kuphal Jul 24 '09 at 21:42
Line 5 should be: ICACLS "%%i" /grant:r "DOMAIN\%%i:(OI)(CI)F" Changed the quotes. – garg Mar 28 '12 at 14:21

For reference, this is the script I used because it suited our environment better

FOR /D %%G IN ("*") DO echo y| cacls "%%G" /T /E /G "DOMAIN\%%G:C"

as we only need to grant the user permissions.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.