I need a script (pref VB) to change permissions on a folder in multiple folders.

I need a script (pref VB) to change permissions on a folder in multiple
folders.


Example, imagine users home directory, so a folder contains all the users.
Each user has a folder inside their home directory called 'examples'. I need
a script to search for that folder inside each users home directory and
change the permissions to 'read, list folder contents'

Can this be done?


This is not being done on users home directories but this was the best
example I could give.


Or imagine their are 10 folders named 1 to 10. inside each folder are 5
folders named A,B,C,D and E. I want a script to search for the folder named
'D' and change the permission on that folder only.

Pegasus
Sat Oct 20 23:36:03 PDT 2007


"Woody" <tosca925@NOSPAMyahoo.co.uk> wrote in message
news:uM0kqF3EIHA.3716@TK2MSFTNGP03.phx.gbl...
>I need a script (pref VB) to change permissions on a folder in multiple
>folders.
>
>
> Example, imagine users home directory, so a folder contains all the users.
> Each user has a folder inside their home directory called 'examples'. I
> need a script to search for that folder inside each users home directory
> and change the permissions to 'read, list folder contents'
>
> Can this be done?
>
>
> This is not being done on users home directories but this was the best
> example I could give.
>
>
> Or imagine their are 10 folders named 1 to 10. inside each folder are 5
> folders named A,B,C,D and E. I want a script to search for the folder
> named 'D' and change the permission on that folder only.
>

Your post is a little vague. You write that you wish to apply "read-only"
permissions to the "examples" folder but you never say WHO is supposed
to have this read-only right. You also do not state if the new permissions
should apply to this folder only or to its subfolders too.

Here is a simple batch file solution to get you started. It will give
everybody read-access to the "examples" folder. Remove the word "echo"
to activate it.

Line1=@echo off
Line2=set target=d:\Users
Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
"examples"') do echo cacls "%%a" /e /r domain\everyone
Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
"examples"') do echo cacls "%%a" /e /g domain\everyone:R

Woody
Sun Oct 21 03:22:23 PDT 2007

Sorry if it seems vague, after reading back to myself I see what you mean.

OK, All our network users have roaming profiles. A lot of them have a habit
of saving large files to their desktops, then complain when it takes an age
to log on because they have a 40mb file on heir desktop. What I wanted to do
was search all the roaming profiles of the users and find the 'Desktop'
folder. Then make that folder on the server read access only or Deny write.

Could this be done the way I mentioned below?


"Pegasus (MVP)" <I.can@fly.com> wrote in message
news:O2%23%23ny6EIHA.4752@TK2MSFTNGP04.phx.gbl...
>
> "Woody" <tosca925@NOSPAMyahoo.co.uk> wrote in message
> news:uM0kqF3EIHA.3716@TK2MSFTNGP03.phx.gbl...
>>I need a script (pref VB) to change permissions on a folder in multiple
>>folders.
>>
>>
>> Example, imagine users home directory, so a folder contains all the
>> users. Each user has a folder inside their home directory called
>> 'examples'. I need a script to search for that folder inside each users
>> home directory and change the permissions to 'read, list folder contents'
>>
>> Can this be done?
>>
>>
>> This is not being done on users home directories but this was the best
>> example I could give.
>>
>>
>> Or imagine their are 10 folders named 1 to 10. inside each folder are 5
>> folders named A,B,C,D and E. I want a script to search for the folder
>> named 'D' and change the permission on that folder only.
>>
>
> Your post is a little vague. You write that you wish to apply "read-only"
> permissions to the "examples" folder but you never say WHO is supposed
> to have this read-only right. You also do not state if the new permissions
> should apply to this folder only or to its subfolders too.
>
> Here is a simple batch file solution to get you started. It will give
> everybody read-access to the "examples" folder. Remove the word "echo"
> to activate it.
>
> Line1=@echo off
> Line2=set target=d:\Users
> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> "examples"') do echo cacls "%%a" /e /r domain\everyone
> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
>
>

Pegasus
Sun Oct 21 04:21:52 PDT 2007

I don't think it is practical or desirable to make a user's desktop
"read-only". I assume that these large files are .mp3 files or video
clips. Here are a couple of alternative approaches to deal with them:

- File screening
(http://www.windowsnetworking.com/articles_tutorials/Implementing-File-Screening-Windows-Server-2003-R2.html)

- Company policy: You formulate a suitable policy that bans the
storage of such files on people's desktop, get it approved by
management, then publish it. You then run a scheduled batch job
every night that will move all banned files to a dedicated disk on
some workstation. Most users will do the right thing immediately.
Those who don't will soon get the message.


"Woody" <tosca925@NOSPAMyahoo.co.uk> wrote in message
news:%239fYIx8EIHA.4752@TK2MSFTNGP04.phx.gbl...
> Sorry if it seems vague, after reading back to myself I see what you mean.
>
> OK, All our network users have roaming profiles. A lot of them have a
> habit of saving large files to their desktops, then complain when it takes
> an age to log on because they have a 40mb file on heir desktop. What I
> wanted to do was search all the roaming profiles of the users and find the
> 'Desktop' folder. Then make that folder on the server read access only or
> Deny write.
>
> Could this be done the way I mentioned below?
>
>
> "Pegasus (MVP)" <I.can@fly.com> wrote in message
> news:O2%23%23ny6EIHA.4752@TK2MSFTNGP04.phx.gbl...
>>
>> "Woody" <tosca925@NOSPAMyahoo.co.uk> wrote in message
>> news:uM0kqF3EIHA.3716@TK2MSFTNGP03.phx.gbl...
>>>I need a script (pref VB) to change permissions on a folder in multiple
>>>folders.
>>>
>>>
>>> Example, imagine users home directory, so a folder contains all the
>>> users. Each user has a folder inside their home directory called
>>> 'examples'. I need a script to search for that folder inside each users
>>> home directory and change the permissions to 'read, list folder
>>> contents'
>>>
>>> Can this be done?
>>>
>>>
>>> This is not being done on users home directories but this was the best
>>> example I could give.
>>>
>>>
>>> Or imagine their are 10 folders named 1 to 10. inside each folder are 5
>>> folders named A,B,C,D and E. I want a script to search for the folder
>>> named 'D' and change the permission on that folder only.
>>>
>>
>> Your post is a little vague. You write that you wish to apply "read-only"
>> permissions to the "examples" folder but you never say WHO is supposed
>> to have this read-only right. You also do not state if the new
>> permissions
>> should apply to this folder only or to its subfolders too.
>>
>> Here is a simple batch file solution to get you started. It will give
>> everybody read-access to the "examples" folder. Remove the word "echo"
>> to activate it.
>>
>> Line1=@echo off
>> Line2=set target=d:\Users
>> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> "examples"') do echo cacls "%%a" /e /r domain\everyone
>> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
>>
>>
>
>

pete0085
Thu Dec 27 22:13:01 CST 2007

I'm trying to do your sample with a folder called C:\test. I am not having
any luck. All I need to do it with is one folder and apply it to the
everyone or domain users group.

You said to remove the word echo, you mean remove all 3 echo? Can someone
be more specific.


> Here is a simple batch file solution to get you started. It will give
> everybody read-access to the "examples" folder. Remove the word "echo"
> to activate it.
>
> Line1=@echo off
> Line2=set target=d:\Users
> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> "examples"') do echo cacls "%%a" /e /r domain\everyone
> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
>
>
>

Pegasus
Fri Dec 28 00:50:34 CST 2007

It helps if you understand a little bit how batch files work
when using them for your own purposes. Write the following
four batch files and run them from a Command Prompt - they
will make the use of the "echo" command much clearer:

Batch file 1:
echo Hello world!
echo My name is Pete.

Batch file 2:
@echo off
echo Hello world!
echo My name is Pete.

Batch file 3:
@echo off
echo dir c:\

Batch file 4:
@echo off
dir c:\

You should now be able to decide which "echo" words
you must remove in order to activate the batch file. You
must, of course, remove the "Line1=" bit as well!


"pete0085" <pete0085@discussions.microsoft.com> wrote in message
news:B7E95F7E-439F-4EB4-B67F-9120260EDBE5@microsoft.com...
> I'm trying to do your sample with a folder called C:\test. I am not
> having
> any luck. All I need to do it with is one folder and apply it to the
> everyone or domain users group.
>
> You said to remove the word echo, you mean remove all 3 echo? Can someone
> be more specific.
>
>
>> Here is a simple batch file solution to get you started. It will give
>> everybody read-access to the "examples" folder. Remove the word "echo"
>> to activate it.
>>
>> Line1=@echo off
>> Line2=set target=d:\Users
>> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> "examples"') do echo cacls "%%a" /e /r domain\everyone
>> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
>>
>>
>>

pete0085
Fri Dec 28 09:24:00 CST 2007

Here is what I'm doing. sorry, I don't know what I am doing wrong. The
folder is on C:\Onbase.

Line1=@echo off
Line2=set target=C:\
Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
"OnBase"') do echo cacls "%%a" /e /r DOMAIN\everyone
Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
"OnBase"') do echo cacls "%%a" /e /g DOMAIN\everyone:F


"Pegasus (MVP)" wrote:

> It helps if you understand a little bit how batch files work
> when using them for your own purposes. Write the following
> four batch files and run them from a Command Prompt - they
> will make the use of the "echo" command much clearer:
>
> Batch file 1:
> echo Hello world!
> echo My name is Pete.
>
> Batch file 2:
> @echo off
> echo Hello world!
> echo My name is Pete.
>
> Batch file 3:
> @echo off
> echo dir c:\
>
> Batch file 4:
> @echo off
> dir c:\
>
> You should now be able to decide which "echo" words
> you must remove in order to activate the batch file. You
> must, of course, remove the "Line1=" bit as well!
>
>
> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
> news:B7E95F7E-439F-4EB4-B67F-9120260EDBE5@microsoft.com...
> > I'm trying to do your sample with a folder called C:\test. I am not
> > having
> > any luck. All I need to do it with is one folder and apply it to the
> > everyone or domain users group.
> >
> > You said to remove the word echo, you mean remove all 3 echo? Can someone
> > be more specific.
> >
> >
> >> Here is a simple batch file solution to get you started. It will give
> >> everybody read-access to the "examples" folder. Remove the word "echo"
> >> to activate it.
> >>
> >> Line1=@echo off
> >> Line2=set target=d:\Users
> >> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> >> "examples"') do echo cacls "%%a" /e /r domain\everyone
> >> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> >> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
> >>
> >>
> >>
>
>
>

pete0085
Fri Dec 28 09:38:00 CST 2007

I tried something else. Any problems with doing this?

call cacls "C:\OnBase" /t /e /g "DOMAIN\DOMAIN USERS":F


"Pegasus (MVP)" wrote:

> It helps if you understand a little bit how batch files work
> when using them for your own purposes. Write the following
> four batch files and run them from a Command Prompt - they
> will make the use of the "echo" command much clearer:
>
> Batch file 1:
> echo Hello world!
> echo My name is Pete.
>
> Batch file 2:
> @echo off
> echo Hello world!
> echo My name is Pete.
>
> Batch file 3:
> @echo off
> echo dir c:\
>
> Batch file 4:
> @echo off
> dir c:\
>
> You should now be able to decide which "echo" words
> you must remove in order to activate the batch file. You
> must, of course, remove the "Line1=" bit as well!
>
>
> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
> news:B7E95F7E-439F-4EB4-B67F-9120260EDBE5@microsoft.com...
> > I'm trying to do your sample with a folder called C:\test. I am not
> > having
> > any luck. All I need to do it with is one folder and apply it to the
> > everyone or domain users group.
> >
> > You said to remove the word echo, you mean remove all 3 echo? Can someone
> > be more specific.
> >
> >
> >> Here is a simple batch file solution to get you started. It will give
> >> everybody read-access to the "examples" folder. Remove the word "echo"
> >> to activate it.
> >>
> >> Line1=@echo off
> >> Line2=set target=d:\Users
> >> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> >> "examples"') do echo cacls "%%a" /e /r domain\everyone
> >> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> >> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
> >>
> >>
> >>
>
>
>

Pegasus
Fri Dec 28 09:43:36 CST 2007

Did you take the time to try the four little batch files
I wrote for you? If yes then try the file below. If not
then you should ask your network administrator to
assist you.

@echo off
set target=C:\
for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i "OnBase"') do
cacls "%%a" /e /r DOMAIN\everyone
for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i "OnBase"') do
cacls "%%a" /e /g DOMAIN\everyone:F


"pete0085" <pete0085@discussions.microsoft.com> wrote in message
news:72676A3E-4C87-4705-A349-2C4755C73CD4@microsoft.com...
> Here is what I'm doing. sorry, I don't know what I am doing wrong. The
> folder is on C:\Onbase.
>
> Line1=@echo off
> Line2=set target=C:\
> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> "OnBase"') do echo cacls "%%a" /e /r DOMAIN\everyone
> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> "OnBase"') do echo cacls "%%a" /e /g DOMAIN\everyone:F
>
>
> "Pegasus (MVP)" wrote:
>
>> It helps if you understand a little bit how batch files work
>> when using them for your own purposes. Write the following
>> four batch files and run them from a Command Prompt - they
>> will make the use of the "echo" command much clearer:
>>
>> Batch file 1:
>> echo Hello world!
>> echo My name is Pete.
>>
>> Batch file 2:
>> @echo off
>> echo Hello world!
>> echo My name is Pete.
>>
>> Batch file 3:
>> @echo off
>> echo dir c:\
>>
>> Batch file 4:
>> @echo off
>> dir c:\
>>
>> You should now be able to decide which "echo" words
>> you must remove in order to activate the batch file. You
>> must, of course, remove the "Line1=" bit as well!
>>
>>
>> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
>> news:B7E95F7E-439F-4EB4-B67F-9120260EDBE5@microsoft.com...
>> > I'm trying to do your sample with a folder called C:\test. I am not
>> > having
>> > any luck. All I need to do it with is one folder and apply it to the
>> > everyone or domain users group.
>> >
>> > You said to remove the word echo, you mean remove all 3 echo? Can
>> > someone
>> > be more specific.
>> >
>> >
>> >> Here is a simple batch file solution to get you started. It will give
>> >> everybody read-access to the "examples" folder. Remove the word "echo"
>> >> to activate it.
>> >>
>> >> Line1=@echo off
>> >> Line2=set target=d:\Users
>> >> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> >> "examples"') do echo cacls "%%a" /e /r domain\everyone
>> >> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> >> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
>> >>
>> >>
>> >>
>>
>>
>>

Pegasus
Fri Dec 28 09:54:16 CST 2007

That's fine but there is no need at all for the "call" command.
"cacls" will do.


"pete0085" <pete0085@discussions.microsoft.com> wrote in message
news:A52902F8-6B53-4374-AC5F-7F502DB21A74@microsoft.com...
>I tried something else. Any problems with doing this?
>
> call cacls "C:\OnBase" /t /e /g "DOMAIN\DOMAIN USERS":F
>
>
> "Pegasus (MVP)" wrote:
>
>> It helps if you understand a little bit how batch files work
>> when using them for your own purposes. Write the following
>> four batch files and run them from a Command Prompt - they
>> will make the use of the "echo" command much clearer:
>>
>> Batch file 1:
>> echo Hello world!
>> echo My name is Pete.
>>
>> Batch file 2:
>> @echo off
>> echo Hello world!
>> echo My name is Pete.
>>
>> Batch file 3:
>> @echo off
>> echo dir c:\
>>
>> Batch file 4:
>> @echo off
>> dir c:\
>>
>> You should now be able to decide which "echo" words
>> you must remove in order to activate the batch file. You
>> must, of course, remove the "Line1=" bit as well!
>>
>>
>> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
>> news:B7E95F7E-439F-4EB4-B67F-9120260EDBE5@microsoft.com...
>> > I'm trying to do your sample with a folder called C:\test. I am not
>> > having
>> > any luck. All I need to do it with is one folder and apply it to the
>> > everyone or domain users group.
>> >
>> > You said to remove the word echo, you mean remove all 3 echo? Can
>> > someone
>> > be more specific.
>> >
>> >
>> >> Here is a simple batch file solution to get you started. It will give
>> >> everybody read-access to the "examples" folder. Remove the word "echo"
>> >> to activate it.
>> >>
>> >> Line1=@echo off
>> >> Line2=set target=d:\Users
>> >> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> >> "examples"') do echo cacls "%%a" /e /r domain\everyone
>> >> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> >> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
>> >>
>> >>
>> >>
>>
>>
>>

pete0085
Fri Dec 28 10:14:02 CST 2007

Well techincally I could be considered our network administrator. I've run
scripts before, but still can't get this to work correctly. i've tried it as
a vbs or batch file. I get no errors, but it doesn't do anything either.

I've tried to substitue Domain Users for everyone.

When I run it in a command prompt, the error comes back as " %%a was
unexpected at this time"

Did you look at the other script I sent in the previous email? Does that
accomlish the same thing?

"Pegasus (MVP)" wrote:

> Did you take the time to try the four little batch files
> I wrote for you? If yes then try the file below. If not
> then you should ask your network administrator to
> assist you.
>
> @echo off
> set target=C:\
> for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i "OnBase"') do
> cacls "%%a" /e /r DOMAIN\everyone
> for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i "OnBase"') do
> cacls "%%a" /e /g DOMAIN\everyone:F
>
>
> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
> news:72676A3E-4C87-4705-A349-2C4755C73CD4@microsoft.com...
> > Here is what I'm doing. sorry, I don't know what I am doing wrong. The
> > folder is on C:\Onbase.
> >
> > Line1=@echo off
> > Line2=set target=C:\
> > Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> > "OnBase"') do echo cacls "%%a" /e /r DOMAIN\everyone
> > Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> > "OnBase"') do echo cacls "%%a" /e /g DOMAIN\everyone:F
> >
> >
> > "Pegasus (MVP)" wrote:
> >
> >> It helps if you understand a little bit how batch files work
> >> when using them for your own purposes. Write the following
> >> four batch files and run them from a Command Prompt - they
> >> will make the use of the "echo" command much clearer:
> >>
> >> Batch file 1:
> >> echo Hello world!
> >> echo My name is Pete.
> >>
> >> Batch file 2:
> >> @echo off
> >> echo Hello world!
> >> echo My name is Pete.
> >>
> >> Batch file 3:
> >> @echo off
> >> echo dir c:\
> >>
> >> Batch file 4:
> >> @echo off
> >> dir c:\
> >>
> >> You should now be able to decide which "echo" words
> >> you must remove in order to activate the batch file. You
> >> must, of course, remove the "Line1=" bit as well!
> >>
> >>
> >> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
> >> news:B7E95F7E-439F-4EB4-B67F-9120260EDBE5@microsoft.com...
> >> > I'm trying to do your sample with a folder called C:\test. I am not
> >> > having
> >> > any luck. All I need to do it with is one folder and apply it to the
> >> > everyone or domain users group.
> >> >
> >> > You said to remove the word echo, you mean remove all 3 echo? Can
> >> > someone
> >> > be more specific.
> >> >
> >> >
> >> >> Here is a simple batch file solution to get you started. It will give
> >> >> everybody read-access to the "examples" folder. Remove the word "echo"
> >> >> to activate it.
> >> >>
> >> >> Line1=@echo off
> >> >> Line2=set target=d:\Users
> >> >> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> >> >> "examples"') do echo cacls "%%a" /e /r domain\everyone
> >> >> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> >> >> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
> >> >>
> >> >>
> >> >>
> >>
> >>
> >>
>
>
>

pete0085
Fri Dec 28 10:42:03 CST 2007

I have full control to domain users for the script. Any reason why a non
admin cannot run the script?


If I am logged in as an admin then it will work.

When running it from the command prompt, I am getting an access denied. It
won't work as a login script either.

"Pegasus (MVP)" wrote:

> That's fine but there is no need at all for the "call" command.
> "cacls" will do.
>
>
> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
> news:A52902F8-6B53-4374-AC5F-7F502DB21A74@microsoft.com...
> >I tried something else. Any problems with doing this?
> >
> > call cacls "C:\OnBase" /t /e /g "DOMAIN\DOMAIN USERS":F
> >
> >
> > "Pegasus (MVP)" wrote:
> >
> >> It helps if you understand a little bit how batch files work
> >> when using them for your own purposes. Write the following
> >> four batch files and run them from a Command Prompt - they
> >> will make the use of the "echo" command much clearer:
> >>
> >> Batch file 1:
> >> echo Hello world!
> >> echo My name is Pete.
> >>
> >> Batch file 2:
> >> @echo off
> >> echo Hello world!
> >> echo My name is Pete.
> >>
> >> Batch file 3:
> >> @echo off
> >> echo dir c:\
> >>
> >> Batch file 4:
> >> @echo off
> >> dir c:\
> >>
> >> You should now be able to decide which "echo" words
> >> you must remove in order to activate the batch file. You
> >> must, of course, remove the "Line1=" bit as well!
> >>
> >>
> >> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
> >> news:B7E95F7E-439F-4EB4-B67F-9120260EDBE5@microsoft.com...
> >> > I'm trying to do your sample with a folder called C:\test. I am not
> >> > having
> >> > any luck. All I need to do it with is one folder and apply it to the
> >> > everyone or domain users group.
> >> >
> >> > You said to remove the word echo, you mean remove all 3 echo? Can
> >> > someone
> >> > be more specific.
> >> >
> >> >
> >> >> Here is a simple batch file solution to get you started. It will give
> >> >> everybody read-access to the "examples" folder. Remove the word "echo"
> >> >> to activate it.
> >> >>
> >> >> Line1=@echo off
> >> >> Line2=set target=d:\Users
> >> >> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> >> >> "examples"') do echo cacls "%%a" /e /r domain\everyone
> >> >> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> >> >> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
> >> >>
> >> >>
> >> >>
> >>
> >>
> >>
>
>
>

Pegasus
Fri Dec 28 11:18:13 CST 2007

*** See below.

"pete0085" <pete0085@discussions.microsoft.com> wrote in message
news:D704BF5E-6C58-407C-B6EB-53570801F213@microsoft.com...
>I have full control to domain users for the script. Any reason why a non
> admin cannot run the script?

*** Because a non-admin does not have sufficient access rights.

> If I am logged in as an admin then it will work.

*** Good.

> When running it from the command prompt, I am getting an access denied.

*** This statement contradicts the previous statement.

> It won't work as a login script either.

*** It will, provided that the user has sufficient access
*** rights and provided that is properly coded.

> "Pegasus (MVP)" wrote:
>
>> That's fine but there is no need at all for the "call" command.
>> "cacls" will do.
>>
>>
>> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
>> news:A52902F8-6B53-4374-AC5F-7F502DB21A74@microsoft.com...
>> >I tried something else. Any problems with doing this?
>> >
>> > call cacls "C:\OnBase" /t /e /g "DOMAIN\DOMAIN USERS":F
>> >
>> >
>> > "Pegasus (MVP)" wrote:
>> >
>> >> It helps if you understand a little bit how batch files work
>> >> when using them for your own purposes. Write the following
>> >> four batch files and run them from a Command Prompt - they
>> >> will make the use of the "echo" command much clearer:
>> >>
>> >> Batch file 1:
>> >> echo Hello world!
>> >> echo My name is Pete.
>> >>
>> >> Batch file 2:
>> >> @echo off
>> >> echo Hello world!
>> >> echo My name is Pete.
>> >>
>> >> Batch file 3:
>> >> @echo off
>> >> echo dir c:\
>> >>
>> >> Batch file 4:
>> >> @echo off
>> >> dir c:\
>> >>
>> >> You should now be able to decide which "echo" words
>> >> you must remove in order to activate the batch file. You
>> >> must, of course, remove the "Line1=" bit as well!
>> >>
>> >>
>> >> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
>> >> news:B7E95F7E-439F-4EB4-B67F-9120260EDBE5@microsoft.com...
>> >> > I'm trying to do your sample with a folder called C:\test. I am not
>> >> > having
>> >> > any luck. All I need to do it with is one folder and apply it to
>> >> > the
>> >> > everyone or domain users group.
>> >> >
>> >> > You said to remove the word echo, you mean remove all 3 echo? Can
>> >> > someone
>> >> > be more specific.
>> >> >
>> >> >
>> >> >> Here is a simple batch file solution to get you started. It will
>> >> >> give
>> >> >> everybody read-access to the "examples" folder. Remove the word
>> >> >> "echo"
>> >> >> to activate it.
>> >> >>
>> >> >> Line1=@echo off
>> >> >> Line2=set target=d:\Users
>> >> >> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> >> >> "examples"') do echo cacls "%%a" /e /r domain\everyone
>> >> >> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> >> >> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
>> >> >>
>> >> >>
>> >> >>
>> >>
>> >>
>> >>
>>
>>
>>

Pegasus
Fri Dec 28 11:20:39 CST 2007


"pete0085" <pete0085@discussions.microsoft.com> wrote in message
news:C355AAF8-B39F-4D80-B727-A2F3343FF4C4@microsoft.com...
> Well techincally I could be considered our network administrator.

You're doing yourself a disservice by not asking your
boss to send you to an server admin course. While
the course costs money, it costs your company far more
in you having to grope around for pieces of information.

pete0085
Fri Dec 28 11:48:01 CST 2007

I will clarify my message. I cannot run the program as a regular user. Is
there a way around this? I do want a regular user to be able to run this
script.

What more rights do they need, if they have full control of the script? The
access denied is displayed when I run it from the command prompt, the script
itself does not give an error message.

Would like to run it as a login script, but running it manually is an
option.

The error is: ACCESS_DENIED: C:\onbase
>below it shows processed file: C:\onbase\temp
and every file below it is processed, but not the folder itself.




cacls "C:\OnBase" /t /e /c /g "SMWFCU\DOMAIN USERS":F

"Pegasus (MVP)" wrote:

> *** See below.
>
> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
> news:D704BF5E-6C58-407C-B6EB-53570801F213@microsoft.com...
> >I have full control to domain users for the script. Any reason why a non
> > admin cannot run the script?
>
> *** Because a non-admin does not have sufficient access rights.
>
> > If I am logged in as an admin then it will work.
>
> *** Good.
>
> > When running it from the command prompt, I am getting an access denied.
>
> *** This statement contradicts the previous statement.
>
> > It won't work as a login script either.
>
> *** It will, provided that the user has sufficient access
> *** rights and provided that is properly coded.
>
> > "Pegasus (MVP)" wrote:
> >
>

Pegasus
Fri Dec 28 12:11:59 CST 2007

Have a look at the NTFS permissions of the problem folder.
What access rights does the user have? If he has no access
rights then he can't change them - that's the essense of file
security!


"pete0085" <pete0085@discussions.microsoft.com> wrote in message
news:1400B0EE-6041-42D1-97B9-E879491B634A@microsoft.com...
>I will clarify my message. I cannot run the program as a regular user. Is
> there a way around this? I do want a regular user to be able to run this
> script.
>
> What more rights do they need, if they have full control of the script?
> The
> access denied is displayed when I run it from the command prompt, the
> script
> itself does not give an error message.
>
> Would like to run it as a login script, but running it manually is an
> option.
>
> The error is: ACCESS_DENIED: C:\onbase
>>below it shows processed file: C:\onbase\temp
> and every file below it is processed, but not the folder itself.
>
>
>
>
> cacls "C:\OnBase" /t /e /c /g "SMWFCU\DOMAIN USERS":F
>
> "Pegasus (MVP)" wrote:
>
>> *** See below.
>>
>> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
>> news:D704BF5E-6C58-407C-B6EB-53570801F213@microsoft.com...
>> >I have full control to domain users for the script. Any reason why a
>> >non
>> > admin cannot run the script?
>>
>> *** Because a non-admin does not have sufficient access rights.
>>
>> > If I am logged in as an admin then it will work.
>>
>> *** Good.
>>
>> > When running it from the command prompt, I am getting an access denied.
>>
>> *** This statement contradicts the previous statement.
>>
>> > It won't work as a login script either.
>>
>> *** It will, provided that the user has sufficient access
>> *** rights and provided that is properly coded.
>>
>> > "Pegasus (MVP)" wrote:
>> >
>>

pete0085
Fri Dec 28 12:31:03 CST 2007

That is the problem I am having. The group domain users was removed somehow
or there is a SID without a name and it was removed.

It's like this on all the pcs, so I'm not sure what happened.

I am trying to find an way to add that group to all the folders.

"Pegasus (MVP)" wrote:

> Have a look at the NTFS permissions of the problem folder.
> What access rights does the user have? If he has no access
> rights then he can't change them - that's the essense of file
> security!
>
>
> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
> news:1400B0EE-6041-42D1-97B9-E879491B634A@microsoft.com...
> >I will clarify my message. I cannot run the program as a regular user. Is
> > there a way around this? I do want a regular user to be able to run this
> > script.
> >
> > What more rights do they need, if they have full control of the script?
> > The
> > access denied is displayed when I run it from the command prompt, the
> > script
> > itself does not give an error message.
> >
> > Would like to run it as a login script, but running it manually is an
> > option.
> >
> > The error is: ACCESS_DENIED: C:\onbase
> >>below it shows processed file: C:\onbase\temp
> > and every file below it is processed, but not the folder itself.
> >
> >
> >
> >
> > cacls "C:\OnBase" /t /e /c /g "SMWFCU\DOMAIN USERS":F
> >
> > "Pegasus (MVP)" wrote:
> >
> >> *** See below.
> >>
> >> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
> >> news:D704BF5E-6C58-407C-B6EB-53570801F213@microsoft.com...
> >> >I have full control to domain users for the script. Any reason why a
> >> >non
> >> > admin cannot run the script?
> >>
> >> *** Because a non-admin does not have sufficient access rights.
> >>
> >> > If I am logged in as an admin then it will work.
> >>
> >> *** Good.
> >>
> >> > When running it from the command prompt, I am getting an access denied.
> >>
> >> *** This statement contradicts the previous statement.
> >>
> >> > It won't work as a login script either.
> >>
> >> *** It will, provided that the user has sufficient access
> >> *** rights and provided that is properly coded.
> >>
> >> > "Pegasus (MVP)" wrote:
> >> >
> >>
>
>
>

pete0085
Fri Dec 28 13:09:02 CST 2007

Would it be possible to run a script that will set the domain users to be a
member of the administrators group? Then run the other script? I don't like
doing this, but would this be a better option?

"Pegasus (MVP)" wrote:

> Have a look at the NTFS permissions of the problem folder.
> What access rights does the user have? If he has no access
> rights then he can't change them - that's the essense of file
> security!
>
>
> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
> news:1400B0EE-6041-42D1-97B9-E879491B634A@microsoft.com...
> >I will clarify my message. I cannot run the program as a regular user. Is
> > there a way around this? I do want a regular user to be able to run this
> > script.
> >
> > What more rights do they need, if they have full control of the script?
> > The
> > access denied is displayed when I run it from the command prompt, the
> > script
> > itself does not give an error message.
> >
> > Would like to run it as a login script, but running it manually is an
> > option.
> >
> > The error is: ACCESS_DENIED: C:\onbase
> >>below it shows processed file: C:\onbase\temp
> > and every file below it is processed, but not the folder itself.
> >
> >
> >
> >
> > cacls "C:\OnBase" /t /e /c /g "SMWFCU\DOMAIN USERS":F
> >
> > "Pegasus (MVP)" wrote:
> >
> >> *** See below.
> >>
> >> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
> >> news:D704BF5E-6C58-407C-B6EB-53570801F213@microsoft.com...
> >> >I have full control to domain users for the script. Any reason why a
> >> >non
> >> > admin cannot run the script?
> >>
> >> *** Because a non-admin does not have sufficient access rights.
> >>
> >> > If I am logged in as an admin then it will work.
> >>
> >> *** Good.
> >>
> >> > When running it from the command prompt, I am getting an access denied.
> >>
> >> *** This statement contradicts the previous statement.
> >>
> >> > It won't work as a login script either.
> >>
> >> *** It will, provided that the user has sufficient access
> >> *** rights and provided that is properly coded.
> >>
> >> > "Pegasus (MVP)" wrote:
> >> >
> >>
>
>
>

pete0085
Sat Dec 29 16:13:01 CST 2007

**I believed I got it figured out. It took me all day and I feel stupid, but
when I ran it as a computer statup script, then it runs ok. I was trying to
run it as a user login script. **

Al
Sat Dec 29 16:28:32 CST 2007

What Pegasus is trying to do is to get you to understand the code. For now,
just change "do echo cacls" wherever it appears to "do cacls".

/Al

"pete0085" <pete0085@discussions.microsoft.com> wrote in message
news:72676A3E-4C87-4705-A349-2C4755C73CD4@microsoft.com...
> Here is what I'm doing. sorry, I don't know what I am doing wrong. The
> folder is on C:\Onbase.
>
> Line1=@echo off
> Line2=set target=C:\
> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> "OnBase"') do echo cacls "%%a" /e /r DOMAIN\everyone
> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
> "OnBase"') do echo cacls "%%a" /e /g DOMAIN\everyone:F
>
>
> "Pegasus (MVP)" wrote:
>
>> It helps if you understand a little bit how batch files work
>> when using them for your own purposes. Write the following
>> four batch files and run them from a Command Prompt - they
>> will make the use of the "echo" command much clearer:
>>
>> Batch file 1:
>> echo Hello world!
>> echo My name is Pete.
>>
>> Batch file 2:
>> @echo off
>> echo Hello world!
>> echo My name is Pete.
>>
>> Batch file 3:
>> @echo off
>> echo dir c:\
>>
>> Batch file 4:
>> @echo off
>> dir c:\
>>
>> You should now be able to decide which "echo" words
>> you must remove in order to activate the batch file. You
>> must, of course, remove the "Line1=" bit as well!
>>
>>
>> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
>> news:B7E95F7E-439F-4EB4-B67F-9120260EDBE5@microsoft.com...
>> > I'm trying to do your sample with a folder called C:\test. I am not
>> > having
>> > any luck. All I need to do it with is one folder and apply it to the
>> > everyone or domain users group.
>> >
>> > You said to remove the word echo, you mean remove all 3 echo? Can
>> > someone
>> > be more specific.
>> >
>> >
>> >> Here is a simple batch file solution to get you started. It will give
>> >> everybody read-access to the "examples" folder. Remove the word "echo"
>> >> to activate it.
>> >>
>> >> Line1=@echo off
>> >> Line2=set target=d:\Users
>> >> Line3=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> >> "examples"') do echo cacls "%%a" /e /r domain\everyone
>> >> Line4=for /F "delims=" %%a in ('dir "%target%" /ad /b ^| find /i
>> >> "examples"') do echo cacls "%%a" /e /g domain\everyone:R
>> >>
>> >>
>> >>
>>
>>
>>

Al
Sat Dec 29 16:35:56 CST 2007

Look at it this way. The code is obviously designed to give all domain users
full access to everything within that folder, right? If they need to do that
it can only be because they do not already have full access. If they do not
have full access, then, by definition, they likely do not have the access
necessary to give themselves full access.

As a local administrator on the workstations in question, you should be able
to do this all remotely:

cacls "\\computer1\c$\OnBase" /t /e /c /g "SMWFCU\DOMAIN USERS":F
cacls "\\computer2\c$\OnBase" /t /e /c /g "SMWFCU\DOMAIN USERS":F

and etc. If there are a lot of computers, you could put their names in a
text file and do something like this:

for /f %%C in (computernames.txt) do cacls "\\%%C\c$\OnBase" /t /e /c /g
"SMWFCU\DOMAIN USERS":F

If some of them are disconnected or otherwise unavailable, then you need to
start looking into a bit of error checking.

I hope this helps.


/Al

"pete0085" <pete0085@discussions.microsoft.com> wrote in message
news:1400B0EE-6041-42D1-97B9-E879491B634A@microsoft.com...
>I will clarify my message. I cannot run the program as a regular user. Is
> there a way around this? I do want a regular user to be able to run this
> script.
>
> What more rights do they need, if they have full control of the script?
> The
> access denied is displayed when I run it from the command prompt, the
> script
> itself does not give an error message.
>
> Would like to run it as a login script, but running it manually is an
> option.
>
> The error is: ACCESS_DENIED: C:\onbase
>>below it shows processed file: C:\onbase\temp
> and every file below it is processed, but not the folder itself.
>
>
>
>
> cacls "C:\OnBase" /t /e /c /g "SMWFCU\DOMAIN USERS":F
>
> "Pegasus (MVP)" wrote:
>
>> *** See below.
>>
>> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
>> news:D704BF5E-6C58-407C-B6EB-53570801F213@microsoft.com...
>> >I have full control to domain users for the script. Any reason why a
>> >non
>> > admin cannot run the script?
>>
>> *** Because a non-admin does not have sufficient access rights.
>>
>> > If I am logged in as an admin then it will work.
>>
>> *** Good.
>>
>> > When running it from the command prompt, I am getting an access denied.
>>
>> *** This statement contradicts the previous statement.
>>
>> > It won't work as a login script either.
>>
>> *** It will, provided that the user has sufficient access
>> *** rights and provided that is properly coded.
>>
>> > "Pegasus (MVP)" wrote:
>> >
>>

Al
Sat Dec 29 16:40:04 CST 2007

Trust your instincts, they are giving you a good warning.

Yes, you could do this by making domain users a member of the domain admins
group (which should confer local admin access to all workstations). But your
next step will be to look for a witness protection program, because you have
given the company away.

Or, you could write a script that would add domain users to the local
administrators group. Of course, you would need to run that script, as
administrator, on every workstation. So why not simply run the permission
changing script that way and be done with it?

Or, better yet, change the permissions remotely on all workstations as I
suggested in an earlier reply.


/Al

"pete0085" <pete0085@discussions.microsoft.com> wrote in message
news:CCECFD95-714C-4D89-B1D8-123A89400B4C@microsoft.com...
> Would it be possible to run a script that will set the domain users to be
> a
> member of the administrators group? Then run the other script? I don't
> like
> doing this, but would this be a better option?
>
> "Pegasus (MVP)" wrote:
>
>> Have a look at the NTFS permissions of the problem folder.
>> What access rights does the user have? If he has no access
>> rights then he can't change them - that's the essense of file
>> security!
>>
>>
>> "pete0085" <pete0085@discussions.microsoft.com> wrote in message
>> news:1400B0EE-6041-42D1-97B9-E879491B634A@microsoft.com...
>> >I will clarify my message. I cannot run the program as a regular user.
>> >Is
>> > there a way around this? I do want a regular user to be able to run
>> > this
>> > script.
>> >
>> > What more rights do they need, if they have full control of the script?
>> > The
>> > access denied is displayed when I run it from the command prompt, the
>> > script
>> > itself does not give an error message.
>> >
>> > Would like to run it as a login script, but running it manually is an
>> > option.
>> >
>> > The error is: ACCESS_DENIED: C:\onbase
>> >>below it s