Login  | |
|
 |
Re: Set NTFS permissions - 4/8/2005 6:13:05 AM
|
|
 |
|
| |
mbouchard
Posts: 1804
Score: 12
Joined: 5/15/2003
From: USA
Status: online
|
Cacls is an old dos command that has been around for quite sometime, while xcacls is relativly new, came with Win2000 resource kit if I remember correctly. And while they have the same base functionality, xcacls gives you more.
|
|
| |
|
|
|
|
Re: Set NTFS permissions - 4/9/2005 9:03:17 AM
|
|
|
|
| |
token
Posts: 1917
Score: 0
Joined: 1/14/2005
From:
Status: offline
|
cjwallace, perhaps you didn't get what I was saying.
Let me try it again. You said "I dont want it to run each time the user logs in and only run if the permissions above are not present." If you do that, you will first check to see what the permissions are, list ALL of them, and compare them based on a condition. Based on your previous request, you will need to have at least two conditions to check for Administrators and Domain Admins. If they failed (meaning if there are OTHER users that belong to that group, say three other users), you will delete those three users. Or you can just add Administrators and Domain Admins back (which are just two users) and overwrite the existing ACL.
Now, lets do some analysis here. If the above conditions holds true, you will need to perform AT LEAST two iterations (for checking Administrators and Domain Admins) plus the one iteration of OVERWRITING the ACL (more if you want to modify existing instead of overwrittin the exsiting ACL). That is three iterations (or 3 things in general) that the scripts need to do.
If you just overwrite the ACL like you did before, that is only ONE thing the scsript needs to do. It has two benefits. First of which is it is more efficient (I believe that's what you want) and secondly, it does the exactly what you want to do.
My question is then, why bother with the less efficient method when both achieves the same result desired ?
Again, the general idea is this. If you want to determine whether "something" EXIST or not and if not, ADD those "something". Why don't you just go ahead and ADD them anyway ? If they are there, then you don't need to ADD those something, but you still spent time on CHECKING the existence of those something when the time you spent could be easily use to ADD them instead.
|
|
| |
|
|
|
|
Re: Set NTFS permissions - 4/11/2005 2:58:39 AM
|
|
|
|
| |
cjwallace
Posts: 484
Score: 0
Joined: 3/5/2005
From: United Kingdom
Status: offline
|
Hi Token. Do you know if what you said will work on windows 2000.
I have tried what you said in our login script but it is not changing the permissions
Below is my login script. Look under Domain Users for the code you said to try
-----------------------------------------
On Error Resume Next
Dim WshNetwork, asdPath, User
Dim strMappedDrives, strStatus
Dim IE
Dim objFSO
set shell = createobject("wscript.shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
rem Const ADS_READONLY_SERVER = 5
' Display IE status window
Call CreateIE()
strStatus = "Please call x6440 with any Login issues " & Date()
ie.document.all.wstatus.InnerText = strMsg3
' Get the User ID
Set WSHNetwork = WScript.CreateObject("WScript.Network")
strUser = ""
While strUser = ""
strUser = WSHNetwork.UserName
Wend
ie.document.all.Msg1.InnerText = strUser
call main()
strStatus = strStatus & vbCRLF & "Withers LLP London Network Logon Complete..."
ie.document.all.wstatus.InnerText = strStatus
' Close IE status window
If not ie.document.all.holdit.checked then
ie.quit()
End if
' End of logon script
Public Sub Main()
'Main loop to detect group that user belongs to
Set objUser = GetObject("WinNT://WITHERS/" & strUser & ",user")
Set dso = GetObject("WinNT:")
For Each Prop In objUser.groups
rem Msgbox Prop.Name
if Prop.Name = "LN Photos" then
Call LNPhotos()
end if
if Prop.Name = "LN DigitalPhotos" then
Call LNDigitalPhotos()
end if
if Prop.Name = "LN Helpdesk" then
Call Helpdesk()
end if
if Prop.Name = "LN Systems" then
Call LondonSystems()
end if
if Prop.Name = "Domain Users" then
Call DomainUsers()
end If
'etc
Next 'Prop
End Sub
Sub LNPhotos()
strStatus = strStatus & vbCRLF & "Member of Marketing Digital Photos..."
ie.document.all.wstatus.InnerText = strStatus
MapDrive "P:", "\\hebe\digitalphotos"
End Sub
Sub LNDigitalPhotos()
strStatus = strStatus & vbCRLF & "Member of JDM Digital Photos..."
ie.document.all.wstatus.InnerText = strStatus
MapDrive "P:", "\\hebe\digitalphotos"
End Sub
Sub LNHelpdesk()
strStatus = strStatus & vbCRLF & "Member of London Helpdesk..."
ie.document.all.wstatus.InnerText = strStatus
MapDrive "I:", "\\Hyperion\itstuff"
MapDrive "Y:", "\\LNFS01\home$"
MapDrive "Z:", "\\LNFS01\Profile$"
End Sub
Sub LNSystems()
strStatus = strStatus & vbCRLF & "Member of London Systems Team..."
ie.document.all.wstatus.InnerText = strStatus
MapDrive "I:", "\\Hyperion\itstuff"
MapDrive "Y:", "\\LNFS01\home$"
MapDrive "Z:", "\\LNFS01\profile$"
End Sub
Sub DomainUsers()
strStatus = strStatus & vbCRLF & "Member of London Domain Users..."
ie.document.all.wstatus.InnerText = strStatus
shell.run ("net time \\LNDC02 /set /yes")
MapDrive "S:", "\\poseidon\data"
MapDrive "V:", "\\poseidon\apps"
shell.run ("net use \\atlas\crispdata")
network = CreateObject("WScript.Network")
username = network.UserName
shell.run "xcacls \\LNFS01\profile$\" & username & " /t /e /G WITHERS\ADMINISTRATOR:F ""WITHERS\DOMAIN ADMINS"":F ""WITHERS\LN HELPDESK:F"" /C /Y",0
End Sub
Sub CreateIE()
On Error Resume Next
Set IE = CreateObject("InternetExplorer.Application")
With IE
.navigate "\\Lndc01\SYSVOL\withers.net\scripts\LN\logon.htm"
.resizable=0
.height=470
.width=350
.menubar=0
.toolbar=0
.statusBar=0
.visible=1
End With
SecondsToDelay = "2"
Wscript.Sleep(SecondsToDelay * 2000)
End Sub
Sub MapDrive(strDrive,strShare)
On Error Resume Next
WSHNetwork.MapNetworkDrive strDrive, strShare
If Err.Number Then
WSHNetwork.RemoveNetworkDrive strDrive
WSHNetwork.MapNetworkDrive strDrive, strShare
End If
strMappedDrives = strMappedDrives & strDrive & " "
ie.document.all.Msg2.InnerText = strMappedDrives
End Sub
|
|
| |
|
|
|
|
|
Printable Version
New Messages
No New Messages
Hot Topic w/ New Messages
Hot Topic w/o New Messages
Locked w/ New Messages
Locked w/o New Messages
Post New Thread