Windows Forum

Ask something
Discussion Locked

Profile Permissions

0 helpful
7 replies

by jon pratt

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Okay here's my problem. I'm scripting in over 3000 user accounts. In our environment we run both w2k pro desktops and W2k terminal services. The users will be logging onto thin clients and PCs. Because of this we have opted to use the terminal services profile option for our user accounts, thus ensuring a higher level of control when our users logon to the terminal servers. I am using the addusers.exe that comes with the W2k server resource kit to script in the accounts(I liked it better than the VB scripts). The script works fine however when the user logs on for the first time, and a profile is created on the server we specified for the terminal services profiles, it sets the ACL for that profile to only allow that particular user access to the profile. We need administrator groups to be able to access the profiles as well. Taking ownership only results in the original user being deleted from the ACL, which defeats our purpose of having the user and administrators being ableto access the profiles. The solution I am looking for is very specific: I need the ACLs for the profiles to allow the user that logs on and Domain Admins access to that profile. Thank you all for your help.

7 replies

by abubin

What wrong with adding the user's ACL back into the profile after taking over the ownership? You only need to do this once and both admin and user will be able to access this profile. I know you have 3000 users but you don't need to go to each one and take ownership 1 by 1. Just do it as it comes along.

by jon pratt

I'm afraid our environment is far too dynamic. I work for a high school district, which means that 25% (i.e. the graduating class) of the users must be deleted and their account info cleaned up every year. Beyond that students move in and out of our area on a frequent basis(large population of migrant workers and their families). The deletion of the user accounts from AD can be done through scripting and taking ownership and deleting the profiles is also a snap. It's the tedious processof applying the individual ACLs during account creation that we're trying to avoid, especially since we'll have to do it so often (at least 25% new accounts every year, freshman class).

by beermonster

Off the cuff, and presuming you don't need access to the profile the minute it's created, a quick fix would be running a script (either nightly \ every 12 hours or whatever) that uses xcacls from the reskit. This util will allow you to take ownership, then edit (rather than replace) the ACL so the users permissions won't be removed. Hope this helps

by jon pratt

BeerMonster,
Anytime you take ownership the ACL is wiped clean. Xcacls has a switch to continue on access denied but it doesn't allow for the /e(edit acl) switch to take ownership by editing the acl. Once ownership is taken the ACL is completely reset. This means that we still have to add the users back to the acl of their individual profiles manually(doing this with xacls wouldn't really automate the process becuase it's a different user for each ACL). The M$ article that talks aboutthis can be found at http://support.microsoft.com/support/kb/articles/Q268/0/19.ASP. Thanks for the suggestion.

by jon pratt

Awesome!! That's what I was looking for. I thought I had picked through GP thoroughly for a solution, but I guess I missed that one. Thanks a million(well actully only 1,200=) RVKEMPEN!

This discussion is closed to new replies.