Reset child permissions / inheritance of folder with script

Hello everyone,

is there any possibility to set inheritance settings with a command line
tool on windos server 2003?

I´d like to set de checkbox "Replace permission entries on all child objects
with entires shown here that apply to child objects" on command line!

I´ve allread tried setacl.exe from http://setacl.sourceforge.net/ with the
parameters:

SetACL.exe -on "d:\webs\www.testweb.com" -ot file -actn ace -ace "i:so"

But there i get the following error:

ERROR in command line: Invalid number of entries in parameter for option
-ace sp
ecified: i:so!

Type 'SetACL -help' for help.

Are there any hints to solve this problem, or is there any tool to fullfit
our needs?

Thank you very much!

Thomas

Hi Thomas,

try xcacls.vbs by Microsoft

HTH Thomas Langer


"Thomas" <ts@sbg.at> schrieb im Newsbeitrag news:efiKI46OHHA.3872@TK2MSFTNGP06.phx.gbl...
> Hello everyone,
>
> is there any possibility to set inheritance settings with a command line
> tool on windos server 2003?
>
> I´d like to set de checkbox "Replace permission entries on all child objects
> with entires shown here that apply to child objects" on command line!
>
> I´ve allread tried setacl.exe from http://setacl.sourceforge.net/ with the
> parameters:
>
> SetACL.exe -on "d:\webs\www.testweb.com" -ot file -actn ace -ace "i:so"
>
> But there i get the following error:
>
> ERROR in command line: Invalid number of entries in parameter for option
> -ace sp
> ecified: i:so!
>
> Type 'SetACL -help' for help.
>
> Are there any hints to solve this problem, or is there any tool to fullfit
> our needs?
>
> Thank you very much!
>
> Thomas
>
>

Hello Thomas,

thank you very much for your help!

I´d like to enable inheritance on all child objects of a folder but not on
the folder itself.

Therefor i used the following syntax: XCACLS.vbs "path" /F /T /S /SPEC E /I
ENABLE

But this operation sets the ACL´s for the "root" folder too!

Is there any possability to set the permissions for the child objects only?

Oder das Ganze auf Deutsch :)

Ich möchte die Berechtigungen nur für Subordner setzen und nicht auf den
eigentlichen Ordner selbst.

In XCACLS.vbs gibt es die Option /F für den change aller Files im Ordner -
OK!

Die Option /T für traverse - OK!

Die Option /S für Subfolder - OK!

und die Option /SPEC E - welche bedeuten sollte nur für Subfolders and
Files...

genau hier ist der springende Punkt, da auch die Inheritance auf den
entsprechenden Ordner gesetzt werden!

Gibt es eine Möglichkeit die Vererbung nur auf die Subordner zu setzen??

Vielen Dank

Thomas

"Thomas Langer" <tlnospam@langer-online.net> schrieb im Newsbeitrag
news:OOLXb$HPHHA.4820@TK2MSFTNGP05.phx.gbl...
> Hi Thomas,
>
> try xcacls.vbs by Microsoft
>
> HTH Thomas Langer
>
>
> "Thomas" <ts@sbg.at> schrieb im Newsbeitrag
> news:efiKI46OHHA.3872@TK2MSFTNGP06.phx.gbl...
>> Hello everyone,
>>
>> is there any possibility to set inheritance settings with a command line
>> tool on windos server 2003?
>>
>> I´d like to set de checkbox "Replace permission entries on all child
>> objects
>> with entires shown here that apply to child objects" on command line!
>>
>> I´ve allread tried setacl.exe from http://setacl.sourceforge.net/ with
>> the
>> parameters:
>>
>> SetACL.exe -on "d:\webs\www.testweb.com" -ot file -actn ace -ace "i:so"
>>
>> But there i get the following error:
>>
>> ERROR in command line: Invalid number of entries in parameter for option
>> -ace sp
>> ecified: i:so!
>>
>> Type 'SetACL -help' for help.
>>
>> Are there any hints to solve this problem, or is there any tool to
>> fullfit
>> our needs?
>>
>> Thank you very much!
>>
>> Thomas
>>
>>
>

On Tue, 23 Jan 2007 10:44:20 +0100, Thomas wrote:

> Hello Thomas,
>
> thank you very much for your help!
>
> I´d like to enable inheritance on all child objects of a folder but not on
> the folder itself.
>
> Therefor i used the following syntax: XCACLS.vbs "path" /F /T /S /SPEC E /I
> ENABLE
>
> But this operation sets the ACL´s for the "root" folder too!
>
> Is there any possability to set the permissions for the child objects only?
>
> Oder das Ganze auf Deutsch :)
>
> Ich möchte die Berechtigungen nur für Subordner setzen und nicht auf den
> eigentlichen Ordner selbst.
>
> In XCACLS.vbs gibt es die Option /F für den change aller Files im Ordner -
> OK!
>
> Die Option /T für traverse - OK!
>
> Die Option /S für Subfolder - OK!
>
> und die Option /SPEC E - welche bedeuten sollte nur für Subfolders and
> Files...
>
> genau hier ist der springende Punkt, da auch die Inheritance auf den
> entsprechenden Ordner gesetzt werden!
>
> Gibt es eine Möglichkeit die Vererbung nur auf die Subordner zu setzen??
>
> Vielen Dank
>
> Thomas
>
> "Thomas Langer" <tlnospam@langer-online.net> schrieb im Newsbeitrag
> news:OOLXb$HPHHA.4820@TK2MSFTNGP05.phx.gbl...
>> Hi Thomas,
>>
>> try xcacls.vbs by Microsoft
>>
>> HTH Thomas Langer
>>
>>
>> "Thomas" <ts@sbg.at> schrieb im Newsbeitrag
>> news:efiKI46OHHA.3872@TK2MSFTNGP06.phx.gbl...
>>> Hello everyone,
>>>
>>> is there any possibility to set inheritance settings with a command line
>>> tool on windos server 2003?
>>>
>>> I´d like to set de checkbox "Replace permission entries on all child
>>> objects
>>> with entires shown here that apply to child objects" on command line!
>>>
>>> I´ve allread tried setacl.exe from http://setacl.sourceforge.net/ with
>>> the
>>> parameters:
>>>
>>> SetACL.exe -on "d:\webs\www.testweb.com" -ot file -actn ace -ace "i:so"
>>>
>>> But there i get the following error:
>>>
>>> ERROR in command line: Invalid number of entries in parameter for option
>>> -ace sp
>>> ecified: i:so!
>>>
>>> Type 'SetACL -help' for help.
>>>
>>> Are there any hints to solve this problem, or is there any tool to
>>> fullfit
>>> our needs?
>>>
>>> Thank you very much!
>>>
>>> Thomas
>>>
>>>
>>

I have a script called ResetInheritance in my script library at
http://www.jdhitsolutions.com/scripts that might help. I strongly encourage
you to test any solution in a non-production environment. I'm sure you are
but you'd be surprised how many people try stuff like this on production
systems without understanding what a script is really doing.
--
Jeffery Hicks
SAPIEN Technologies - Scripting, Simplified. www.SAPIEN.com
VBScript & Windows PowerShell Training -
www.ScriptingTraining.com/classes.asp
Windows PowerShell? - www.SAPIENPress.com/powershell.asp

blog: http://blog.SAPIEN.com
blog: http://jdhitsolutions.blogspot.com

Hello Jeffery,

is there any was to reset the permissions for existing files and folders?

Thank you very much

Thomas
"Jeffery Hicks" <"jhicks[at]SAPIEN.com"> schrieb im Newsbeitrag
news:rdsjy2786f5b.anr99mvnms9e$.dlg@40tude.net...
> On Tue, 23 Jan 2007 10:44:20 +0100, Thomas wrote:
>
>> Hello Thomas,
>>
>> thank you very much for your help!
>>
>> I´d like to enable inheritance on all child objects of a folder but not
>> on
>> the folder itself.
>>
>> Therefor i used the following syntax: XCACLS.vbs "path" /F /T /S /SPEC E
>> /I
>> ENABLE
>>
>> But this operation sets the ACL´s for the "root" folder too!
>>
>> Is there any possability to set the permissions for the child objects
>> only?
>>
>> Oder das Ganze auf Deutsch :)
>>
>> Ich möchte die Berechtigungen nur für Subordner setzen und nicht auf den
>> eigentlichen Ordner selbst.
>>
>> In XCACLS.vbs gibt es die Option /F für den change aller Files im
>> Ordner -
>> OK!
>>
>> Die Option /T für traverse - OK!
>>
>> Die Option /S für Subfolder - OK!
>>
>> und die Option /SPEC E - welche bedeuten sollte nur für Subfolders and
>> Files...
>>
>> genau hier ist der springende Punkt, da auch die Inheritance auf den
>> entsprechenden Ordner gesetzt werden!
>>
>> Gibt es eine Möglichkeit die Vererbung nur auf die Subordner zu setzen??
>>
>> Vielen Dank
>>
>> Thomas
>>
>> "Thomas Langer" <tlnospam@langer-online.net> schrieb im Newsbeitrag
>> news:OOLXb$HPHHA.4820@TK2MSFTNGP05.phx.gbl...
>>> Hi Thomas,
>>>
>>> try xcacls.vbs by Microsoft
>>>
>>> HTH Thomas Langer
>>>
>>>
>>> "Thomas" <ts@sbg.at> schrieb im Newsbeitrag
>>> news:efiKI46OHHA.3872@TK2MSFTNGP06.phx.gbl...
>>>> Hello everyone,
>>>>
>>>> is there any possibility to set inheritance settings with a command
>>>> line
>>>> tool on windos server 2003?
>>>>
>>>> I´d like to set de checkbox "Replace permission entries on all child
>>>> objects
>>>> with entires shown here that apply to child objects" on command line!
>>>>
>>>> I´ve allread tried setacl.exe from http://setacl.sourceforge.net/ with
>>>> the
>>>> parameters:
>>>>
>>>> SetACL.exe -on "d:\webs\www.testweb.com" -ot file -actn ace -ace "i:so"
>>>>
>>>> But there i get the following error:
>>>>
>>>> ERROR in command line: Invalid number of entries in parameter for
>>>> option
>>>> -ace sp
>>>> ecified: i:so!
>>>>
>>>> Type 'SetACL -help' for help.
>>>>
>>>> Are there any hints to solve this problem, or is there any tool to
>>>> fullfit
>>>> our needs?
>>>>
>>>> Thank you very much!
>>>>
>>>> Thomas
>>>>
>>>>
>>>
>
> I have a script called ResetInheritance in my script library at
> http://www.jdhitsolutions.com/scripts that might help. I strongly
> encourage
> you to test any solution in a non-production environment. I'm sure you
> are
> but you'd be surprised how many people try stuff like this on production
> systems without understanding what a script is really doing.
> --
> Jeffery Hicks
> SAPIEN Technologies - Scripting, Simplified. www.SAPIEN.com
> VBScript & Windows PowerShell Training -
> www.ScriptingTraining.com/classes.asp
> Windows PowerShell? - www.SAPIENPress.com/powershell.asp
>
> blog: http://blog.SAPIEN.com
> blog: http://jdhitsolutions.blogspot.com

I'll second xcacls.vbs, but too problems with it - there is an MS executable
with the same name - BAD BAD, and it takes freaking FOREVER! However, it
does avoid path length problems because it recursively navigates down into
each folder structure to apply the permissions.

--

Mike Matheny


"Thomas Langer" <tlnospam@langer-online.net> wrote in message
news:OOLXb$HPHHA.4820@TK2MSFTNGP05.phx.gbl...
> Hi Thomas,
>
> try xcacls.vbs by Microsoft
>
> HTH Thomas Langer
>
>
> "Thomas" <ts@sbg.at> schrieb im Newsbeitrag
> news:efiKI46OHHA.3872@TK2MSFTNGP06.phx.gbl...
>> Hello everyone,
>>
>> is there any possibility to set inheritance settings with a command line
>> tool on windos server 2003?
>>
>> I´d like to set de checkbox "Replace permission entries on all child
>> objects
>> with entires shown here that apply to child objects" on command line!
>>
>> I´ve allread tried setacl.exe from http://setacl.sourceforge.net/ with
>> the
>> parameters:
>>
>> SetACL.exe -on "d:\webs\www.testweb.com" -ot file -actn ace -ace "i:so"
>>
>> But there i get the following error:
>>
>> ERROR in command line: Invalid number of entries in parameter for option
>> -ace sp
>> ecified: i:so!
>>
>> Type 'SetACL -help' for help.
>>
>> Are there any hints to solve this problem, or is there any tool to
>> fullfit
>> our needs?
>>
>> Thank you very much!
>>
>> Thomas
>>
>>
>

Hello Mike,

i´ve tried to solve the problem with xcalcls.vbs - but as you said the
performance is more than poor. On a folder with about 50 files and about 50
MB it takes up to 5 minutes...

hmmm


"Mike Matheny" <thomasdotmdotmathenyatnasadotgov> schrieb im Newsbeitrag
news:egclZp9PHHA.4672@TK2MSFTNGP06.phx.gbl...
> I'll second xcacls.vbs, but too problems with it - there is an MS
> executable with the same name - BAD BAD, and it takes freaking FOREVER!
> However, it does avoid path length problems because it recursively
> navigates down into each folder structure to apply the permissions.
>
> --
>
> Mike Matheny
>
>
> "Thomas Langer" <tlnospam@langer-online.net> wrote in message
> news:OOLXb$HPHHA.4820@TK2MSFTNGP05.phx.gbl...
>> Hi Thomas,
>>
>> try xcacls.vbs by Microsoft
>>
>> HTH Thomas Langer
>>
>>
>> "Thomas" <ts@sbg.at> schrieb im Newsbeitrag
>> news:efiKI46OHHA.3872@TK2MSFTNGP06.phx.gbl...
>>> Hello everyone,
>>>
>>> is there any possibility to set inheritance settings with a command line
>>> tool on windos server 2003?
>>>
>>> I´d like to set de checkbox "Replace permission entries on all child
>>> objects
>>> with entires shown here that apply to child objects" on command line!
>>>
>>> I´ve allread tried setacl.exe from http://setacl.sourceforge.net/ with
>>> the
>>> parameters:
>>>
>>> SetACL.exe -on "d:\webs\www.testweb.com" -ot file -actn ace -ace "i:so"
>>>
>>> But there i get the following error:
>>>
>>> ERROR in command line: Invalid number of entries in parameter for option
>>> -ace sp
>>> ecified: i:so!
>>>
>>> Type 'SetACL -help' for help.
>>>
>>> Are there any hints to solve this problem, or is there any tool to
>>> fullfit
>>> our needs?
>>>
>>> Thank you very much!
>>>
>>> Thomas
>>>
>>>
>>
>
>

Quote:

---

Originally Posted by Thomas

Hello everyone,

I´ve allread tried setacl.exe from http://setacl.sourceforge.net/ with the
parameters:

SetACL.exe -on "d:\webs\www.testweb.com" -ot file -actn ace -ace "i:so"

But there i get the following error...

Thomas

---

(I know this is an old quote, posting for the people Googleing out there.)

To set owner to "Administrators", stripp all custom file permissions on, and reset inheratance on all of the CONTENTS of a specific folder and leave the ACL on the folder itself untouched use:

Code:

---

set foo=d:\webs\www.testwebs.com
SetACL.exe -silent -on "%foo%\*" -ot file -actn setprot -rec cont_obj -actn setowner -ownr "n:S-1-5-32-544;s:y" -actn clear -clr "dacl,sacl"

---

My last post had an incorrect command line, do NOT use it. instead use this modified script.

Remember: This script sets the owner to Administrators, removes all custom file permissions, and sets the "inherit from parent" flag of the CONTENTS of the directory you set in %foo% without modifying the permissions of %foo%

Code:

---

SET foo=D:\data
SetACL.exe -silent -on "%foo%\*" -ot file -actn setprot -op "dacl:np;sacl:np" -rec cont_obj -actn setowner -ownr "n:S-1-5-32-544;s:y" -actn clear -clr "dacl,sacl"

---