none
How to make mass change of owners and ACLs on user's redirected folders?

    Question

  • Permissions on hundreds of user's redirected folders where set up incorrectly by a prior worker who was creating folders by hand as a new account was created over a period of years.  This is causing folder redirection policies to fail. We can change the root folder NTFS and share permissions by hand in a few minutes. 

    However, we need to change the individual user's NTFS permissions of their folder and subfoldfers to the Microsoft recommendations as well as assign each user as owner of their own data.

    These are the recommended permissions

    http://technet.microsoft.com/en-us/library/cc775853(v=ws.10).aspx

    %Username%

    Full Control, Owner Of Folder

    Full Control, Owner Of Folder

    Local System

    Full Control

    Full Control

    Administrators

    No Permissions

    No Permissions

    Everyone

    No Permissions

    No Permissions

    We need administrators to also have full control so they can manage the folders without having to become owner and set permissions manually each time.  Is simply unchecking the Grant the user exclusive rights to My Documents box enough to do that or should Administrators be granted full control as part of the ACLS?

    The user's folder name is their user name.

    Is there a way to do this with a bat file or some other method that will take all the existing folder names to grab the users name and then grant the permissions above so someone doesn't have to reset these permissions one by one by hand?

    There are likely some folders remaining from users who no longer exist that were not cleaned up (so permissions and ownership based on the folder name would not work in those folders).  Can a script deal with this without failing (maybe move them and flag them for further review so a human can determine if the folder name was simply misspelled or if the user is really gone)?






    • Edited by MyGposts Saturday, February 25, 2012 8:27 PM
    Saturday, February 25, 2012 8:09 PM

Answers