Controlling ACE for a file from a script

  • Thread starter Thread starter Thomas Iwang
  • Start date Start date
T

Thomas Iwang

Hi folks
I have a problem - I am trying to create an vbs
script which can modify the DACL for an given file - but I
am not sure how to do - can somebody help?? Icannot use
cacls.exe because I need to set permissions for a file
some special users like NT Authority\SYSTEM - and this
gives me a little challange.
What I need is a simple script (just a sample) which shows
how to remove the ACE from a DACL for BUILTIN\Users and
setting the permission for the virtual NT AUTHORITY
account SYSTEM to Read & Write on an given file dummy.txt.
Hast somebody an sample I can reuse for my purpose ??

Kind regards
Thomas Iwang
 
Thomas Iwang said:
What I need is a simple script (just a sample) which shows
how to remove the ACE from a DACL for BUILTIN\Users and
setting the permission for the virtual NT AUTHORITY
account SYSTEM to Read & Write on an given file dummy.txt.
Hast somebody an sample I can reuse for my purpose ??
Click to expand...

Take a look at SetACL: http://setacl.sourceforge.net/
 
Ritchie is correct, SetAcl can pretty much do anything with permissions
but it is extremely tedious to learn how to use.

XCacls (ResKit) works basically like Cacls only with more features and
control.
 
Hi folks

Thanks for the idea - but - I have to do it from WSH
through the Win32 mgmts interface because these
application refuse to accept "NT Authority\System" as an
account to assign permissions to - which gives some sort
of sense since this account doesn't exist as an user. If
you download the DLL ADsSecurity.dll you have the
possibility to add the needed permissions - but - I have
to distribute this script to ~ 50 servers (none of them
are locale) run it as an batch-job and cross my fingers
that nothing went wrong. That DLL also has to be
distributed then and until now the only thing I have seen
install and run automatically without problems are mostly
know as a virus.
So I would prefer to do it directly from Win32-managment
without that DLL - anyone out there ever tried to do
this ??

Kind regards
Thomas Iwang
 
Hi folks

Thanks for the idea - but - I have to do it from WSH
through the Win32 mgmts interface because these
application refuse to accept "NT Authority\System" as an
Click to expand...

Just use "SYSTEM" instead of "NT Authority\System"
 
Ritchie is correct, SetAcl can pretty much do anything with permissions
but it is extremely tedious to learn how to use.

XCacls (ResKit) works basically like Cacls only with more features and
control.
Click to expand...

WAIT! Xcacls.exe from the reskit does not work under CP/2000 because it
does not understand inheritance. Use xcacls.vbs and you will be okay, but
then you need to understand a lot about scripting. My vote is for
SETACL.EXE
 
WAIT! Xcacls.exe from the reskit does not work under CP/2000 because it
does not understand inheritance. Use xcacls.vbs and you will be okay, but
then you need to understand a lot about scripting. My vote is for
SETACL.EXE
Click to expand...

I don't understand your post (or it is incorrect) because I use XCopy on
Win2000
(and NT, XP, 2003) regularly.

Again, SetAcl will do most anything regarding permissions but it is very
tedious
to use, even for command line gurus.
 
Back
Top