Setting permissions on home folders

I have recently issued disk quotas on my home folders:

at server:
dirquota autoquota add /path:\Users /sourcetemplate:"max 6gb"

then to ensure that all files in subdirs actually belongs to users and not administrators (which might have changed ownership
during years), I want to replace ownership on all sub-folders using the following script:
(run from server):

for /f %%i in ('dir /b /a:d') do (
rem rd /s /q "%%i"
cscript xcacls.vbs %%i /o mydomain \%%i /T
)

however xcacls.vbs and any other script I've tested seem to return the following error on the users top-level folder:
Error: This security ID may not be assigned as the owner of this object. (Msg#543)

If I do this manually (right click users folder and click properties, Security tab, Advanced, Owner, and set the owner to the
correct user, and check Replace owner on subcontainers and objects), it works fine! However I need a command that do this.


--
-- HAL07, Engineering Services, Norway

HAL07 wrote:
> I have recently issued disk quotas on my home folders:
>
> at server:
> dirquota autoquota add /path:\Users /sourcetemplate:"max 6gb"
>
> then to ensure that all files in subdirs actually belongs to users and
> not administrators (which might have changed ownership during years), I
> want to replace ownership on all sub-folders using the following script:
> (run from server):
>
> for /f %%i in ('dir /b /a:d') do (
> rem rd /s /q "%%i"
> cscript xcacls.vbs %%i /o mydomain \%%i /T
> )
>
> however xcacls.vbs and any other script I've tested seem to return the
> following error on the users top-level folder:
> Error: This security ID may not be assigned as the owner of this object.
> (Msg#543)
>
> If I do this manually (right click users folder and click properties,
> Security tab, Advanced, Owner, and set the owner to the correct user,
> and check Replace owner on subcontainers and objects), it works fine!
> However I need a command that do this.
>
>
@echo off
for /f %%i in ('dir /b /a:d') do (
subinacl.exe /subdirectories "%%i" /setowner="mydomain\%%i"
)


did the trick. thanks for listening

--
-- HAL07, Engineering Services, Norway