Old Windows 2003 box holding shared folders that's being decommissioned. There's a folder being shared, inside this folder is one folder per user. Each folder has that user added to the security with full permissions. Then any user created sub folders below that...

I want to make it so they can only read from their folders for the next month prior to decommissioning. So remove full and write permissions, for each user.

In linux this would be chmod -R 550 . (where they had something like 770 before)

It looks like CACLS would be what I want to use in Windows world, but it looks like you would have to specify a username for it. I can't just strip write permission for *. So I'd need some kind of recursive batch script on a windows 2003 box for several thousand folders to read the username, file, and modify the files permissions for that username.

This seems like a headache, even if it works (I'm not convinced it wouldn't break everything).

Is there an easier way? For example, if I added permissions for the object everyone to the root folder and denied it write permissions, would this take precedence over a users individual permissions below? Or is there a way I'm not seeing to strip write permissions without defining every user/folder in a script?

  • Have the folders in the share the same name as the users who should be given read permissions? If so, you could use variables (meaning the folder names) to specify the CACLS command. – Lenniey Jun 8 '15 at 15:50
  • They are at the first level, after that users can create their own folders. I could find a way to write that into the logic I'm sure, it seems like the hard way of solving the problem though. – BeanBagKing Jun 8 '15 at 16:06
  • Are the permissions the same post the month end (eg the monthly_readers group is the reader permission post month end) – Jim B Jun 8 '15 at 18:58

One way to do this would be to grant the Domain Users group the appropriate permissions on the parent folder and to check the Replace all existing inheritable permissions on all descendants with inheritable permissions from this object checkbox in the Advanced Security Settings on the parent folder. This will replace the permissions on all of the child folders with the permissions from the parent folder.

  • Yes, but each child folder has different permissions. I don't want User A to be able to read User B's files just because they are both domain users. If I understand the solution correctly, this won't work. Current users still need to be able to access only their files. – BeanBagKing Jun 8 '15 at 16:04
  • OK, understood. The problem with trying to push a Deny permission from the parent is that an Explicit Allow will over-ride an Inherited Deny. – joeqwerty Jun 8 '15 at 16:06

I believe I've found an appropriate non-complicated script capable of doing what I need.

for /F "tokens=1,2,3 delims=:" %%i in (fixacl.lst) do xcacls d:\share\%%i /T /g CONTOSO\%%i:R Administrators:F /Y

This should take a list of usernames (or a list of directories, since every directory has an associated user and vice versa, 1:1) andoverwrite the permissions, recursively with the domain\username:readonly and Administrator:full control. Since it's based on a list I don't have to worry about sub directories that have different names.

In rough psudo code...

For each line in the file fixacl.lst
Grab the name and set it to the variable %%i
then xcalcs on the directory of that name
With xcalcs options for recursive and replace
Read Only for that user
Full control for the administrator
and Yes to everything

The simplest answer is change the permissions on the share itself. Change the user group, or the users individually if they were added to the share that way, from whatever they are to Read.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.