folder permission

[Hernan Seijas]

I want to set permissions for the documents folder in all computers in the
domain
I want that only the user can access to this folder.
Is there a way to do it with GPO??
thanks

 

[Steven L Umbach]

You can use Group Policy/computer configuration/security settings/file
system to apply permissions to "computers" within the scope of influence of
the policy. This should be tested first and in my opinion never applied to
the domain container but an OU possibly and be careful NOT to configure root
folder permissions with the "replace" permissions or you can mess up your
permissions for user profile folders and others. In general try to avoid
configuring permissions at the root level. Another possibility is to use a
Group Policy startup [runs in system context] or logon script [depending on
exactly what you want to configure] using cacls or xcacls to configure
permissions for a folder. Again be sure to test out first to make sure you
get the expected results. --- Steve

http://support.microsoft.com/kb/322241/EN-US/ -- Group Policy startup and
logn scripts.
http://support.microsoft.com/default.aspx?scid=kb;en-us;135268 -- cacls in
a batch file.
http://www.ss64.com/nt/cacls.html -- cacls syntax

 

[Hernan Seijas]

but i can't setup that only the local admin of each computer can access to
it

You can use Group Policy/computer configuration/security settings/file
system to apply permissions to "computers" within the scope of influence
of the policy. This should be tested first and in my opinion never applied
to the domain container but an OU possibly and be careful NOT to configure
root folder permissions with the "replace" permissions or you can mess up
your permissions for user profile folders and others. In general try to
avoid configuring permissions at the root level. Another possibility is to
use a Group Policy startup [runs in system context] or logon script
[depending on exactly what you want to configure] using cacls or xcacls to
configure permissions for a folder. Again be sure to test out first to
make sure you get the expected results. --- Steve

http://support.microsoft.com/kb/322241/EN-US/ -- Group Policy startup and
logn scripts.
http://support.microsoft.com/default.aspx?scid=kb;en-us;135268 -- cacls
in a batch file.
http://www.ss64.com/nt/cacls.html -- cacls syntax

I want to set permissions for the documents folder in all computers in
the domain
I want that only the user can access to this folder.
Is there a way to do it with GPO??
thanks

 

[Roger Abell]

You have not been fully clear on what it is that you
do want. You have stated

I want to set permissions for the documents folder
in all computers in the domain
I want that only the user can access to this folder. and now
but i can't setup that only the local admin of each
computer can access to it

First, are you speaking of each individual account's
My Documents, or are you speaking of the Shared
Documents available to all accounts?
Are you meaning that some area, on a per account
basis should be accessible by only that user account,
or by that user account and the machine local admins,
or ?
By saying "local admins" are you meaning only the
machine local accounts that are admins, thus excluding
any domain accounts such as Domain Admins ?

I believe it is true to say that the above can be done,
but I cannot tell which you are after.

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA

but i can't setup that only the local admin of each computer can access to
it

You can use Group Policy/computer configuration/security settings/file
system to apply permissions to "computers" within the scope of influence
of the policy. This should be tested first and in my opinion never applied
to the domain container but an OU possibly and be careful NOT to configure
root folder permissions with the "replace" permissions or you can mess up
your permissions for user profile folders and others. In general try to
avoid configuring permissions at the root level. Another possibility is to
use a Group Policy startup [runs in system context] or logon script
[depending on exactly what you want to configure] using cacls or xcacls to
configure permissions for a folder. Again be sure to test out first to
make sure you get the expected results. --- Steve

http://support.microsoft.com/kb/322241/EN-US/ -- Group Policy startup and
logn scripts.
http://support.microsoft.com/default.aspx?scid=kb;en-us;135268 -- cacls
in a batch file.
http://www.ss64.com/nt/cacls.html -- cacls syntax

I want to set permissions for the documents folder in all computers in
the domain
I want that only the user can access to this folder.
Is there a way to do it with GPO??
thanks