http://www.yakk0.org/2009/02/26/fun-with-icacls/ a blog on technology in the real world Wed, 23 Jun 2010 11:36:14 +0000 hourly 1 http://wordpress.org/?v=3.3.1 http://www.yakk0.org/2009/02/26/fun-with-icacls/comment-page-1/#comment-71 Jon Bohack Sat, 09 Jan 2010 19:54:01 +0000 http://www.yakk0.org/2009/02/26/fun-with-icacls/#comment-71 Yep the change from full permissions to modify will keep the users from changing their permissions with minimal or zero effect 99.5% of the time. The owner of the file also has the permissions to change the permissions at the NTFS level. So if you grant full control at the share level then the user has permissions regardless with the combined permissions. If you put modify permissions on the share the effective permissions are change and the share permissions will filter out the snafu of ownership. You have my email if you would like to chat. Oh I also just finished a blog entry about icacls you might be interested in. Since Windows 2008, Vista and 7 are moving that way, however it looks like you are familiar with icacls. http://www.bohack.com/2009/12/mastering-permissions-with-icacls-exe-command-thru-the-gui/ Yep the change from full permissions to modify will keep the users from changing their permissions with minimal or zero effect 99.5% of the time. The owner of the file also has the permissions to change the permissions at the NTFS level. So if you grant full control at the share level then the user has permissions regardless with the combined permissions. If you put modify permissions on the share the effective permissions are change and the share permissions will filter out the snafu of ownership. You have my email if you would like to chat. Oh I also just finished a blog entry about icacls you might be interested in. Since Windows 2008, Vista and 7 are moving that way, however it looks like you are familiar with icacls. http://www.bohack.com/2009/12/mastering-permissions-with-icacls-exe-command-thru-the-gui/

]]> http://www.yakk0.org/2009/02/26/fun-with-icacls/comment-page-1/#comment-63 Jeremy Sun, 13 Dec 2009 18:41:59 +0000 http://www.yakk0.org/2009/02/26/fun-with-icacls/#comment-63 Hey, I'm in western PA too! Yeah, I'm sure there are better permission settings, but I was just following the Microsoft recommended settings. The permissions were really messed up when I started. I'll look into using change instead of Full. Hey, I’m in western PA too!
Yeah, I’m sure there are better permission settings, but I was just following the Microsoft recommended settings. The permissions were really messed up when I started. I’ll look into using change instead of Full.

]]> http://www.yakk0.org/2009/02/26/fun-with-icacls/comment-page-1/#comment-62 Jon Bohack Sat, 12 Dec 2009 03:10:06 +0000 http://www.yakk0.org/2009/02/26/fun-with-icacls/#comment-62 I was admiring your script and work for a college in Western Pennsylvania. We set the student's directories to modify control on the NTFS permission and change control on the share permissions. I find that students will fool around with the permissions and lock themselves out of their own directories and me as well. I noticed that you are granting full permissions. Actually if the share is set to full control they will have NTFS permissions of change permissions regardless if they own the file. I was admiring your script and work for a college in Western Pennsylvania. We set the student’s directories to modify control on the NTFS permission and change control on the share permissions. I find that students will fool around with the permissions and lock themselves out of their own directories and me as well. I noticed that you are granting full permissions. Actually if the share is set to full control they will have NTFS permissions of change permissions regardless if they own the file.

]]>