Windows Forum

Ask something
Discussion Locked

File Permissions

0 helpful
5 replies

by jschoepf

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello;
We are in the process of migrating our Novell applications and data to a windows 2000 servers (SP2). The Windows 2000 servers are part of a NT 4 domain structure. Our data migration is being performed manually. We have developed BAT and CMDscripts to create the identical directory structure for applications and user data on all remote servers, We use XCACLS in the script to secure the structures.

We have run into an interesting problem. when we set file permissions to our program exe directories to read and execute on windows 2000, we see numerous violations in our audit event log, event id 560. Information obtained from the event log indicates that attributes of the file (exe) are being updated when the application is executed. If I grant the advance file permission of Write Attributes in addition to Read and execute the audit failures disappear.

Questions: Is it a requirement that you must give The Write attribute permission when you grant Read and exec access.Is it possible to use XCACLS to assign the write attribute permission? Can you deactivate the updating of attribute information when accessing a file for read and exec access.

Thanks
John

5 replies

by joseph moore

1) If an application is writing to TMP files (or updating DAT files) or just trying to write to any file in its directory structure, NTFS perissions can interfere with that. Applications running use the hidden account SYSTEM as the account. Normally, the SYSTEM account should have FC permissions, so you don't have any problems like this.

by joseph moore

2)Yes, XCACLS can modify the ACLs to give an account any type of rights. Here is the help file for XCACLS:

Displays or modifies access control lists (ACLs) of files

XCACLS filename [/T] [/E|/X] [/C] [/G user:perm;spec] [/R user [...]] [/P user:perm;spec [...]] [/D user [...]] [/Y]
filename Displays ACLs.
/T Changes ACLs of specified files in
the current directory and all subdirectories.
/E Edit ACL instead of replacing it.
/X Same as /E except it only affects the ACEs that the
specified users already own.
/C Continue on access denied errors.
/G user:perm;spec Grant specified user access rights.
Perm can be: R Read
C Change (write)
F Full control
P Change Permissions (Special access) O Take Ownership (Special access)
X EXecute (Special access)
E REad (Special access)
W Write (Special access)
D Delete (Special access)
Spec can be the same as perm and will only be

by joseph moore

Continued:

Press ENTER to continue...

applied to a directory. In this case, Perm
will be used for file inheritence in this
directory. If not omitted: Spec=Perm.Special values
for Spec only:
T Not Specified (for file inherit,
only for dirs valid)
At least one access right has to follow!
Entries between ';' and T will be ignored!

/R user Revoke specified user's access rights.
/P user:perm;spec Replace specified user's access rights. for access right specification see /G option
/D user Deny specified user access.
/Y Replace user's rights without verify

Wildcards can be used to specify more that one file in a command.
You can specify more than one user in a command.
You can combine access rights.

by jschoepf

In the above description, the file attributes are being updated when the individual runs the application. It is the users nt account that is being flaged on the event log(Event id 560) The permission on the program exe are Read and Execute. Does Win 2000 now require the Write attribute permission to be granted inaddition to Read and exec?

This discussion is closed to new replies.