Hi, I have a problem with xcacls.vbs We have 2 groups ready for each folder (one for Read, one for Modification permissions). For example : Fold1 Fold2 Fold2_Sub1 Fold2_Sub2 Fold_2_Sub2_Sub1 Fold_2_Sub2_Sub2 .... cscript xcacls.vbs "\\server\g$\Share\Fold1" /E /G "DOM\Fold1-R":X /F cscript xcacls.vbs "\\server\g$\Share\Fold1" /E /G "DOM\Fold1-M":M /F cscript xcacls.vbs "\\server\g$\Share\Fold2" /E /G "DOM\Fold2-R":X /F cscript xcacls.vbs "\\server\g$\Share\Fold2" /E /G "DOM\Fold2-M":M /F cscript xcacls.vbs "\\server\g$\Share\Fold2\Fold2_Sub1" /E /G "DOM\Fold2_Sub1-R":X /F cscript xcacls.vbs "\\server\g$\Share\Fold2\Fold2_Sub2" /E /G "DOM\Fold2_Sub2-M":M /F .... Why I do this, the read and change groups are ok on the first level, but the go down every level on the files. We also tried using the "/SPEC D" switch, but the permissions continue to inherit every level, most of the time only on the files. Each folder needs to have their two groups (read and change), but nothing should inherit down to subfolders, except for the security ACE's put on top, on the share itself. I'm tired (and french), so I hope I'm clear enough. Please help. Thanks a lot.
Hi, OK, I found the solution for my problem. I new xcacls.exe had been "replaced" by xcacls.vbs, but apparently, xcacls.vbs has now been "replaced" by icacls.exe ... at least for Windows Server 2008 (my server). Confusing ... So it works perfectly with icacls : Read : icacls \\server\g$\Services\DFSP /grant DL-S-Services.DFSP-LOI)(NP)RX Write : icacls \\server\g$\Services\DFSP /grant DL-S-Services.DFSP-MOI)(NP)M These are the correct options (for my needs listed in my frst post). BTW, watch out for the switchs. For example, the change/modify permission is : xcacls.exe : C (Change) xcacls.vbs : M (Modify) icacls.exe : M (Modify)
OK, juste a last little update to my post, with what I finally did, if someone's interested : On the nodes (so people cannot create files and folders) : icacls G:\Services\DFSP /grant DL-S-Services.DFSP-LOI)(NP)(IO)(RX) icacls G:\Services\DFSP /grant DL-S-Services.DFSP-MOI)(NP)(IO)(M) icacls G:\Services\DFSP /grant DL-S-Services.DFSP-LS,RD,X) icacls G:\Services\DFSP /grant DL-S-Services.DFSP-MS,RD,X) On the "leaves" (last folders) so people CAN create new folders/files : icacls G:\Services\DFSP\DAF\CDG /grant DL-S-Services.DFSP.DAF.CDG-LOI)(CI)(IO)(RX) icacls G:\Services\DFSP\DAF\CDG /grant DL-S-Services.DFSP.DAF.CDG-MOI)(CI)(IO)(M) icacls G:\Services\DFSP\DAF\CDG /grant DL-S-Services.DFSP.DAF.CDG-LS,RD,X) icacls G:\Services\DFSP\DAF\CDG /grant DL-S-Services.DFSP.DAF.CDG-MS,RD,WD,AD,X)
