Re: c:\ drive permissions

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 06/24/05

  • Next message: visu: "Spam monitoring yahoo details" 
    Date: Fri, 24 Jun 2005 00:02:20 -0500

    Try using Group Policy to apply the rootsec.inf security template to those
    computers via Group Policy. However do NOT do this at the domain level but
    instead move the computers into an OU, even if just temporarily, to do such.
    Create a test OU with such Group Policy linked to it and move a few
    computers into it to see if it works as expected. Reboot the computers or
    use gpupdate to speed up the application of that Group Policy. If you do
    roll it out, remove or unlink that GPO that has the rootsec.inf template
    imported into it after all the computers have been updated so that the
    computers will not be refreshing those ntfs settings as once they are
    applied then they will stay unless modified by another GPO or
    nually. --- Steve

    "Nathan" <caseynathan@hotmail.com> wrote in message
    news:e1IyjEFeFHA.796@TK2MSFTNGP09.phx.gbl...
    > The Desktop team in our department has been deploying PC's with the C:\
    > drive
    > permissions changed. They thought it would be convenient for the user if
    > everyone had full control of the entire c:\ drive.
    > I now need to return the c:\ drive permissions back to winxp standard. If
    > I
    > go the advances security tab for the c:\ drive and edit the permissions
    > for
    > the "everyone" group and change the "Everyone" permission to:
    > Traverse Folder / Execute File
    > List folder / Read Data
    > Read Attributes
    > Read Extended Attributes
    > Read Permissions
    > I then Select "This Folder Only" in the "Apply onto" drop down menu.
    > Now the sub directories now longer inherit the "everyone" group
    > permissions.
    >
    > Since I need this done on several hundred PC's I have been testing
    > subinacl.exe
    > I ran the following command on a fresh winxp install to get a backup of
    > the
    > default c:\ drive permissions:
    > subinacl /noverbose /output=c:\aclbackups.txt /file c:\
    >
    > I then ran "subinacl /playfile c:\aclbackups.txt" on a PC that had the c:\
    > permissions changed.
    > The command changed the c:\ permissions back to base winxp c:\ drive
    > permissions but the sub folders still had inherited the "everyone" group
    > full
    > control. On the advanced permissions tab of a sub directory the "Inherited
    > From" section showed "Parent Object" instead of "C:\"
    >
    > Any ideas on how I can change the C:\ drive and sub directories back to
    > winxp base permissions would be greatly appreciated.
    > Thanks
    > Nathan
    >
    >
    >

  • Next message: visu: "Spam monitoring yahoo details"

    Relevant Pages

    • Assigned application fails to install
      ... I have assigned an Office 2000 installation to computers ... "The machine account for the workstation does not have permissions ... When a workstation runs Group Policy, it does so in the context of the ...
      (microsoft.public.win2000.active_directory)
    • Re: managed software
      ... I have tried giving domain computers read permissions to the file and ... i have even gone as far as to provide everyone with read permissions ... This issue may occur if the computers do not ... > Packages Assigned to Computers with Group Policy Are Not Installed ...
      (microsoft.public.windows.server.sbs)
    • Re: Allow domain user to change local permissions on domain computers, without have full right on do
      ... >I would like give a domain user permission to change and reset ... I have delegated permission for them to add/remove computers ... You can use Group Policy to set file system permissions. ...
      (microsoft.public.win2000.group_policy)
    • RE: deny logon access to groups
      ... GPO to that OU and grant the Read + "Apply Group Policy" permissions to the ... > computers, but is there a way to allow/deny GROUPS from logging into ...
      (microsoft.public.win2000.general)
    • Re: Change registry permissions on all domain pcs using GP
      ... this can be dome by creating a custom security template with the desired ... GPO.. ... How do I change the permissions on the key (and all keys ... that) shown below in Group Policy? ...
      (microsoft.public.windows.group_policy)