Re: Adding multiple entries for the same user with xcacls...

Hi again Condiment,

Thank you for your thanks, but your apollogetic approach
is not needed. All I am saying is that I have not had the
kind of problem you report, when using /e, and I have used
it to grant multiple things to a principal. However, I am also
saying that one does not always end up with what one expects,
but with something equivalent. For an example, making a grant
of read on this folder, and another of read/write on subfolders
and files can be equivalently stated as a grant of read on this
folder, subfolders and files, and another of write on subfolders
and files. The apis used by xcacls seem to "optimize" according
to some canonicalization rules I have never seem mentioned or
documented if they exist as such; but one should end up with
something functionally equal to what was there for the principal
plus what was added with use of /e /g

Roger


"Condiment" <condiment@xxxxxxxxx> wrote in message
news:uqgZHikzHHA.1100@xxxxxxxxxxxxxxxxxxxxxxx
I am trying to say "grant specific security for GoupA to Subfolders and
files only" and "grant specific security for GroupA to This folder only".
I guess this is just not possible with xcacls. I really appreciate your
response and understand that my responses are teetering on the edge of
annoying at this point. I can tell you with all honesty I have read the -?
command a dozen times and you are the only one responding, so thank you
once again. If you know of any way to ADD a user or group twice with
different security, that would help me a tremendously.

"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message
news:uMFQbWbzHHA.4004@xxxxxxxxxxxxxxxxxxxxxxx
It you are using /g for Principal with the /e switch it should
update the existing ACE/ACEs for Principal. If it can do
this by modifying the existing ACE/ACEs without adding
another, that would be expected.
You are apparently saying
ACE/ACEs before use of /g /e
+ intended grant via /g /e
does not equal ACE/ACEs for Principal afterwards.
??

"Condiment" <condiment@xxxxxxxxx> wrote in message
news:eV5VnJUzHHA.1204@xxxxxxxxxxxxxxxxxxxxxxx
I think I am still missing something.

Even running /E it still updates the existing entry instead of creating
a new one (different /SPEC syntax for each) for the group that I am
granting permissions to. Any ideas what I am misisng here?

"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message
news:OjvA0PpyHHA.748@xxxxxxxxxxxxxxxxxxxxxxx
"Condiment" <condiment@xxxxxxxxx> wrote in message
news:e6ROWXoyHHA.3564@xxxxxxxxxxxxxxxxxxxxxxx
Roger,
Thank you a million times. I briefly attempted the /E switch, but
when I received a syntax error, I just assumed I was heading down the
wrong path.

been there , guessing of syntax

What I failed to realize is that /E can be used with /G. You rock.

:)


Thank you again.

To you too - :)

--
ra

"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message
news:OQO7cunyHHA.3772@xxxxxxxxxxxxxxxxxxxxxxx
You appear to be overlooking the /e switch, which mean Edit the
existing grants for the principal rather than replacing them

<condiment@xxxxxxxxx> wrote in message
news:1184869275.987891.121480@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hello,
Is there a way to add multiple entires for the same user using
xcacls? I am open to other suggestions, but here is what I need to
do...

I need to give Domain Admins specific access to "Subfolders and
Files".

I also need to give Domain Admins specific access to "This Folder
only"

When I use xcacls, the last command just overwrites the first... I
realize that /G replaces the existing settings, however I do not see
any options to accomplish what I need. If there is another tool to
accomplish this, I am open to other possibilities.

cscript xcacls.vbs test /I COPY /SPEC A /G "Domain Admins":618423B

cscript xcacls.vbs test /I COPY /SPEC E /G "Domain Admins":6184237AB

Thank you in advance













.

Relevant Pages

  • Re: "Full Disclosure"
    ... He's saying "if I permit people to do X, then I have to spend time ... they aren't part of the request, and they aren't things he would have ... to do in order to grant people permission or share the source. ...
    (rec.games.bridge)
  • Re: Adding multiple entries for the same user with xcacls...
    ... I am trying to say "grant specific security for GoupA to Subfolders and files only" and "grant specific security for GroupA to This folder only". ... update the existing ACE/ACEs for Principal. ...
    (microsoft.public.windows.server.security)
  • Re: Callcom Free Grant money for a fee
    ... >call from a John Fields who gave me his agent number 132 saying I was ... >Jackson who asked for my bank account number and a check number as they ... >had to charge me $296.96 in order to process this grant check. ...
    (rec.arts.books.tolkien)
  • Re: CRB Checking 16-18 year olds
    ... In message, Dave writes ... As Grant says all three of us have met and he is correct in saying that he ... is younger than either of us. ...
    (uk.rec.scouting)
  • Callcom Free Grant money for a fee
    ... call from a John Fields who gave me his agent number 132 saying I was ... Jackson who asked for my bank account number and a check number as they ... had to charge me $296.96 in order to process this grant check. ...
    (rec.arts.books.tolkien)