#154207 - 2005-12-29 12:14 AM
NTFS Permissions
|
daniel1982
Getting the hang of it
Registered: 2005-03-23
Posts: 77
Loc: Sydney, Australia
|
Hello,
I'm using cacls to change permissions on some files, however it's not giving me the outcome I want. I realise this is not really a Kix problem, but just wondering if anyone has any ideas...
Basically the situation is that I have an ini file which I want users and administrators of the local pc to be able to read (actually the application running as the user account), but not to be able to modify the contents, delete, move or change the filename. The only users who should have access to this is the applications admin group in AD.
By giving the AD admins group FC, and the local users group Read and execute access, I have been able to achieve this. The problem lies with the local administrators group. I haven't been able to find the correct permissions to deny them modify permissions, without explicity denying both the local users and local admins full control, but then they cannot open the file either.
I realise that local admins would be able to change the permissions back to modify themselves, but we are hoping to play on most users ignorance of NTFS permissions.
Any help would be appreciated.
|
|
Top
|
|
|
|
#154209 - 2005-12-29 12:29 AM
Re: NTFS Permissions
|
daniel1982
Getting the hang of it
Registered: 2005-03-23
Posts: 77
Loc: Sydney, Australia
|
Hi Les,
I'm not sure if it's an issues with CACLS or not, I've tried manually modifying the permissions to what I want, but I haven't been able to get the permissions I need...
What i'm saying is, I need help defining >what< the permissions should be, not deploying them onto the file.
|
|
Top
|
|
|
|
|
#154211 - 2005-12-29 01:15 AM
Re: NTFS Permissions
|
daniel1982
Getting the hang of it
Registered: 2005-03-23
Posts: 77
Loc: Sydney, Australia
|
hmmm...So NTDOC, there's no way to deny administrators modify rights whilst also being able to read the file?
|
|
Top
|
|
|
|
|
#154216 - 2005-12-29 01:36 AM
Re: NTFS Permissions
|
daniel1982
Getting the hang of it
Registered: 2005-03-23
Posts: 77
Loc: Sydney, Australia
|
NTDoc, do you mean not having permissions inherited from the parent? I've unchecked the box in the GUI and administrators can still rename/delete the file...
|
|
Top
|
|
|
|
|
#154218 - 2005-12-29 01:45 AM
Re: NTFS Permissions
|
daniel1982
Getting the hang of it
Registered: 2005-03-23
Posts: 77
Loc: Sydney, Australia
|
That's got it!
Thanks Doc!
|
|
Top
|
|
|
|
|
#154219 - 2005-12-29 02:00 AM
Re: NTFS Permissions
|
daniel1982
Getting the hang of it
Registered: 2005-03-23
Posts: 77
Loc: Sydney, Australia
|
I've done some tests, and it pretty much works, the only problem I've found is that admin users can delete the file (although they cannot recreate another one in the directory). Because they can't write to the directory, it means they can't update the ini file, but it would be good to disallow them to delete as well...
Is there a simple way to do this?
|
|
Top
|
|
|
|
|
#154221 - 2005-12-29 02:25 AM
Re: NTFS Permissions
|
daniel1982
Getting the hang of it
Registered: 2005-03-23
Posts: 77
Loc: Sydney, Australia
|
You mean:
C:\TEMP\TEST.INI
ACL=Administrators - READ ONLY
ACL=Domain Users - READ ONLY
ACL=AD Admin - FULL CONTROL
for the ini file?
I'm a little confused; Shouldn't the permissions changed on the parent be automatically propogated to the child?
|
|
Top
|
|
|
|
|
#154223 - 2005-12-29 02:48 AM
Re: NTFS Permissions
|
daniel1982
Getting the hang of it
Registered: 2005-03-23
Posts: 77
Loc: Sydney, Australia
|
OK, it seems to be working, if I uncheck inheritance from the folder (C:\Temp in your example). I didn't have to uncheck anything or manually change perms on the files (?).
Can you use Cacls to uncheck the inheritance box? I'm looking at the help page, not sure if i can use something like CI, OI or IO?
|
|
Top
|
|
|
|
|
#154224 - 2005-12-29 02:52 AM
Re: NTFS Permissions
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11631
Loc: CA
|
Quote:
Can you use Cacls to uncheck the inheritance box?
Don't recall off the top of my head, but I would think one of those utilities would allow you to.
|
|
Top
|
|
|
|
|
#154226 - 2005-12-29 03:34 AM
Re: NTFS Permissions
|
daniel1982
Getting the hang of it
Registered: 2005-03-23
Posts: 77
Loc: Sydney, Australia
|
Yes I don't think Cacls let you do it, however Xcacls.vbs from Microsoft allows you to select/deselect the checkbox.
Thanks for all of your help!
|
|
Top
|
|
|
|
Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 764 anonymous users online.
|
|
|
