Re: One for the NTFS permissions gurus.

"Ian" <Ian@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:8CC06FC6-36BE-4D85-9FA5-1FA1E99B68AE@xxxxxxxxxxxxxxxx
A workstation backup-script runs under the logged-on user's credentials, and
copies the user's important data to a subfolder of a server-share. When a new
user logs-on the script creates a new subfolder based on the username.

This has been working for a long time and is a very useful precaution, but
the security isn't too good in that knowledgeable users could in principle
access other people's backups with a bit of poking-around.

What I want to do is to set the permissions on the parent folder (the shared
one) so that when the script creates a new user-folder the permissions on
this will be such that Administrators and the folder's owner have full
control, but other users have no rights.

Is this possible? I've tried all combinations of rights I can think of, but
none seem to achieve this goal. The Administrators rights are no problem, but
the new folder cannot be created unless Authenticated Users or Everyone are
granted rights to subfolders - which defeats the purpose.

I'm thinking along the lines that a process running on the server could scan
the tree periodically and change the folder-rights according to the owner of
the contents, but that's a clunky solution. There ought to be a way to do
this with permissions.. but I if so I can't seem to find it. Any ideas?




Might the 'cacls' command in your script do what you want to set access control list on the folder?

.

Relevant Pages

  • Re: script to find all files in folder/subfolders
    ... folder, including sub-folders but I can't get the subfolder part to work. ... Set colFiles = objWMIService.ExecQuery _ ... good reason to use a VB Script to perform the task. ...
    (microsoft.public.windows.server.scripting)
  • Re: Problem with security rights
    ... secutity rights (Read only on the folder) ... but read and write on everything that this subfolder contains. ... the read only parts comes directly from the parent folder Template so every ...
    (microsoft.public.security)
  • Re: Xcacls - Recusive script on folders and subfolders - Dummy question !!!
    ... > Can you tell me how to change your script to level 2 in folder ... > only (or how to be able to parameter the folder and subfolder level)? ... >> the end) and save the result to a different file for each subfolder. ...
    (microsoft.public.win2000.cmdprompt.admin)
  • Re: creating folder tree structures
    ... SUBFOLDER B ... to end the script. ... particular folder structure is setup in our file servers. ... and I think I should get this setup as it's ...
    (microsoft.public.scripting.vbscript)
  • Folder Permissions - delete
    ... there are just folder upon subfolder ... upon subfolder of word documents and excel ect. ... rights to do anything but delete, and domain users have full rights to ...
    (microsoft.public.win2000.security)