Questions

applying folder permissions through group policy

Tags:
+
0 Votes
Locked

applying folder permissions through group policy

fotaros
Hi there

Is there a way to change a specific folder security privilege of a domain computer through
group policy.

In other words i have 50 PCs joined in a domain i want to add write privileges in a specific folder for a specific group. I want to do it without having to manually reconfigure each computer.

Is there a way to do it through domain group policy. I suppose it could be done my start up scripting but is there another way?

Thank you
  • +
    0 Votes
    scott_heath

    I do not believe you can do this. Run a script that uses cacls.exe to fix the permissions. It's fast and easy. Let me know if you need help.

    +
    0 Votes
    fotaros

    Thanks for the info.

    In the same aspect is there a way for mass configuration? For example i would like to turn off windows update on all computers on my domain.

    I have done it once with RPC but is there a more delicate way for example with SMS or something?

    Thank you

    +
    0 Votes
    scott_heath

    ... can be configured through Domain Policies. Pretty much any registry modification can be made via GPO.

    For the folder rights I would right a script that checks the current rights and if the desired rights do not exist it adds them.

    You could use cacls.exe or vbscript.

    +
    0 Votes
    scott_heath

    You cna apply folder rights through GPO as another poster described. Sorry about the mis-information!

    +
    0 Votes
    sgt_shultz

    you are going to need to configure the folder security. but maybe you could batch cacls

    +
    4 Votes
    patrick.oconnell

    Just go to Group policy editor and computer configuration/windows settings/security settings/file system

    Right click add file, then you browse to the folder (if it is being done on the server and the folder is not there cerate it so you can find the path then you can set the permissions by double clicking the folder in the file system.........

    +
    0 Votes
    jonwitts

    Thanks Patrick - I have been looking for that for ages now! ;-)

    +
    0 Votes
    mchvgs

    Patrick,
    Same idea here, but i want to create the permissions "Security Access" on the remote "Win 7" computer.

    My setup is i have a system that needs access to a specific drive, and folder on remote machines. The reference you gave seems to give access to the local server files not the remote machine files that would fall within that OU that the policy is being applied?
    Any help would be a much appreciated!
    Thx

    +
    0 Votes
    mchvgs

    as a follow up, I already have the GPO creating the share for the folder I want access to, but in creating the share it offers no "access security" permissions. The bad thing is once the GPO creates the share, the permissions defaultly show as "everyone". This is not the desired result, so I am looking to remove "everyone" and add permissions for a few active directory accounts and groups.

    Thx again

    +
    0 Votes
    atuldeshmukh

    for software installations one can allow entire C root permission as well as Registry local and class root hives permissions to the required OU's via GP, a am looking for MSI installer permissions via GP

    +
    0 Votes
    sgt_shultz

    you are going to need to configure the folder security. but maybe you could batch cacls

    +
    4 Votes
    patrick.oconnell

    Just go to Group policy editor and computer configuration/windows settings/security settings/file system

    Right click add file, then you browse to the folder (if it is being done on the server and the folder is not there cerate it so you can find the path then you can set the permissions by double clicking the folder in the file system.........

    +
    0 Votes
    atuldeshmukh

    for software installations one can allow entire C root permission as well as Registry local and class root hives permissions to the required OU's via GP, a am looking for MSI installer permissions via GP

  • +
    0 Votes
    scott_heath

    I do not believe you can do this. Run a script that uses cacls.exe to fix the permissions. It's fast and easy. Let me know if you need help.

    +
    0 Votes
    fotaros

    Thanks for the info.

    In the same aspect is there a way for mass configuration? For example i would like to turn off windows update on all computers on my domain.

    I have done it once with RPC but is there a more delicate way for example with SMS or something?

    Thank you

    +
    0 Votes
    scott_heath

    ... can be configured through Domain Policies. Pretty much any registry modification can be made via GPO.

    For the folder rights I would right a script that checks the current rights and if the desired rights do not exist it adds them.

    You could use cacls.exe or vbscript.

    +
    0 Votes
    scott_heath

    You cna apply folder rights through GPO as another poster described. Sorry about the mis-information!

    +
    0 Votes
    sgt_shultz

    you are going to need to configure the folder security. but maybe you could batch cacls

    +
    4 Votes
    patrick.oconnell

    Just go to Group policy editor and computer configuration/windows settings/security settings/file system

    Right click add file, then you browse to the folder (if it is being done on the server and the folder is not there cerate it so you can find the path then you can set the permissions by double clicking the folder in the file system.........

    +
    0 Votes
    jonwitts

    Thanks Patrick - I have been looking for that for ages now! ;-)

    +
    0 Votes
    mchvgs

    Patrick,
    Same idea here, but i want to create the permissions "Security Access" on the remote "Win 7" computer.

    My setup is i have a system that needs access to a specific drive, and folder on remote machines. The reference you gave seems to give access to the local server files not the remote machine files that would fall within that OU that the policy is being applied?
    Any help would be a much appreciated!
    Thx

    +
    0 Votes
    mchvgs

    as a follow up, I already have the GPO creating the share for the folder I want access to, but in creating the share it offers no "access security" permissions. The bad thing is once the GPO creates the share, the permissions defaultly show as "everyone". This is not the desired result, so I am looking to remove "everyone" and add permissions for a few active directory accounts and groups.

    Thx again

    +
    0 Votes
    atuldeshmukh

    for software installations one can allow entire C root permission as well as Registry local and class root hives permissions to the required OU's via GP, a am looking for MSI installer permissions via GP

    +
    0 Votes
    sgt_shultz

    you are going to need to configure the folder security. but maybe you could batch cacls

    +
    4 Votes
    patrick.oconnell

    Just go to Group policy editor and computer configuration/windows settings/security settings/file system

    Right click add file, then you browse to the folder (if it is being done on the server and the folder is not there cerate it so you can find the path then you can set the permissions by double clicking the folder in the file system.........

    +
    0 Votes
    atuldeshmukh

    for software installations one can allow entire C root permission as well as Registry local and class root hives permissions to the required OU's via GP, a am looking for MSI installer permissions via GP