Sign in with
Sign up | Sign in
Your question

c: drive permissions

Last response: in Windows XP
Share
Anonymous
June 27, 2005 11:01:02 AM

Archived from groups: microsoft.public.windowsxp.general (More info?)

The Desktop team in our department has been deploying PC’s with the C:\ drive
permissions changed. They thought it would be convenient for the user if
everyone had full control of the entire c:\ drive.
I now need to return the c:\ drive permissions back to winxp standard. If I
go the advances security tab for the c:\ drive and edit the permissions for
the “everyone� group and change the "Everyone" permission to:
Traverse Folder / Execute File
List folder / Read Data
Read Attributes
Read Extended Attributes
Read Permissions
I then Select “This Folder Only� in the “Apply onto� drop down menu.
Now the sub directories now longer inherit the “everyone� group permissions.

Since I need this done on several hundred PC’s I have been testing
subinacl.exe
I ran the following command on a fresh winxp install to get a backup of the
default c:\ drive permissions:
subinacl /noverbose /output=c:\aclbackups.txt /file c:\

I then ran “subinacl /playfile c:\aclbackups.txt� on a PC that had the c:\
permissions changed.
The command changed the c:\ permissions back to base winxp c:\ drive
permissions but the sub folders still had inherited the “everyone� group full
control. On the advanced permissions tab of a sub directory the “Inherited
From� section showed “Parent Object� instead of “C:\�

Any ideas on how I can change the C:\ drive and sub directories back to
winxp base permissions would be greatly appreciated.
Thanks
Nathan

More about : drive permissions

Anonymous
June 28, 2005 4:07:46 AM

Archived from groups: microsoft.public.windowsxp.general (More info?)

Type Security Templates in Help and look at some predefined ones, esp Default.

--
--------------------------------------------------------------------------------------------------
http://webdiary.smh.com.au/archives/_comment/001075.htm...
=================================================
<ncasey@nospam.postalias> wrote in message news:B4535D90-7A04-40F2-AD1F-08C3B7F318AC@microsoft.com...
> The Desktop team in our department has been deploying PC’s with the C:\ drive
> permissions changed. They thought it would be convenient for the user if
> everyone had full control of the entire c:\ drive.
> I now need to return the c:\ drive permissions back to winxp standard. If I
> go the advances security tab for the c:\ drive and edit the permissions for
> the “everyone” group and change the "Everyone" permission to:
> Traverse Folder / Execute File
> List folder / Read Data
> Read Attributes
> Read Extended Attributes
> Read Permissions
> I then Select “This Folder Only” in the “Apply onto” drop down menu.
> Now the sub directories now longer inherit the “everyone” group permissions.
>
> Since I need this done on several hundred PC’s I have been testing
> subinacl.exe
> I ran the following command on a fresh winxp install to get a backup of the
> default c:\ drive permissions:
> subinacl /noverbose /output=c:\aclbackups.txt /file c:\
>
> I then ran “subinacl /playfile c:\aclbackups.txt” on a PC that had the c:\
> permissions changed.
> The command changed the c:\ permissions back to base winxp c:\ drive
> permissions but the sub folders still had inherited the “everyone” group full
> control. On the advanced permissions tab of a sub directory the “Inherited
> From” section showed “Parent Object” instead of “C:\”
>
> Any ideas on how I can change the C:\ drive and sub directories back to
> winxp base permissions would be greatly appreciated.
> Thanks
> Nathan
>
Anonymous
June 28, 2005 4:07:47 AM

Archived from groups: microsoft.public.windowsxp.general (More info?)

Unfortunately the PC’s are still in a NT 4 Domain. I have no way of deploying
the security policy via gpo. I need to find a scriptable solution.
Thanks
Nathan


"David Candy" wrote:

> Type Security Templates in Help and look at some predefined ones, esp Default.
>
> --
> --------------------------------------------------------------------------------------------------
> http://webdiary.smh.com.au/archives/_comment/001075.htm...
> =================================================
> <ncasey@nospam.postalias> wrote in message news:B4535D90-7A04-40F2-AD1F-08C3B7F318AC@microsoft.com...
> > The Desktop team in our department has been deploying PC’s with the C:\ drive
> > permissions changed. They thought it would be convenient for the user if
> > everyone had full control of the entire c:\ drive.
> > I now need to return the c:\ drive permissions back to winxp standard. If I
> > go the advances security tab for the c:\ drive and edit the permissions for
> > the “everyone� group and change the "Everyone" permission to:
> > Traverse Folder / Execute File
> > List folder / Read Data
> > Read Attributes
> > Read Extended Attributes
> > Read Permissions
> > I then Select “This Folder Only� in the “Apply onto� drop down menu.
> > Now the sub directories now longer inherit the “everyone� group permissions.
> >
> > Since I need this done on several hundred PC’s I have been testing
> > subinacl.exe
> > I ran the following command on a fresh winxp install to get a backup of the
> > default c:\ drive permissions:
> > subinacl /noverbose /output=c:\aclbackups.txt /file c:\
> >
> > I then ran “subinacl /playfile c:\aclbackups.txt� on a PC that had the c:\
> > permissions changed.
> > The command changed the c:\ permissions back to base winxp c:\ drive
> > permissions but the sub folders still had inherited the “everyone� group full
> > control. On the advanced permissions tab of a sub directory the “Inherited
> > From� section showed “Parent Object� instead of “C:\�
> >
> > Any ideas on how I can change the C:\ drive and sub directories back to
> > winxp base permissions would be greatly appreciated.
> > Thanks
> > Nathan
> >
>
Related resources
Anonymous
June 28, 2005 5:24:34 AM

Archived from groups: microsoft.public.windowsxp.general (More info?)

What has GPO's got to do with it. secedit applies these templates. That is scriptable. But you need to check that it can fix what you did.

--
--------------------------------------------------------------------------------------------------
http://webdiary.smh.com.au/archives/_comment/001075.htm...
=================================================
<ncasey@nospam.postalias> wrote in message news:7CAB89EF-085D-4E86-97A8-881CF73D99ED@microsoft.com...
> Unfortunately the PC’s are still in a NT 4 Domain. I have no way of deploying
> the security policy via gpo. I need to find a scriptable solution.
> Thanks
> Nathan
>
>
> "David Candy" wrote:
>
>> Type Security Templates in Help and look at some predefined ones, esp Default.
>>
>> --
>> --------------------------------------------------------------------------------------------------
>> http://webdiary.smh.com.au/archives/_comment/001075.htm...
>> =================================================
>> <ncasey@nospam.postalias> wrote in message news:B4535D90-7A04-40F2-AD1F-08C3B7F318AC@microsoft.com...
>> > The Desktop team in our department has been deploying PC’s with the C:\ drive
>> > permissions changed. They thought it would be convenient for the user if
>> > everyone had full control of the entire c:\ drive.
>> > I now need to return the c:\ drive permissions back to winxp standard. If I
>> > go the advances security tab for the c:\ drive and edit the permissions for
>> > the “everyone” group and change the "Everyone" permission to:
>> > Traverse Folder / Execute File
>> > List folder / Read Data
>> > Read Attributes
>> > Read Extended Attributes
>> > Read Permissions
>> > I then Select “This Folder Only” in the “Apply onto” drop down menu.
>> > Now the sub directories now longer inherit the “everyone” group permissions.
>> >
>> > Since I need this done on several hundred PC’s I have been testing
>> > subinacl.exe
>> > I ran the following command on a fresh winxp install to get a backup of the
>> > default c:\ drive permissions:
>> > subinacl /noverbose /output=c:\aclbackups.txt /file c:\
>> >
>> > I then ran “subinacl /playfile c:\aclbackups.txt” on a PC that had the c:\
>> > permissions changed.
>> > The command changed the c:\ permissions back to base winxp c:\ drive
>> > permissions but the sub folders still had inherited the “everyone” group full
>> > control. On the advanced permissions tab of a sub directory the “Inherited
>> > From” section showed “Parent Object” instead of “C:\”
>> >
>> > Any ideas on how I can change the C:\ drive and sub directories back to
>> > winxp base permissions would be greatly appreciated.
>> > Thanks
>> > Nathan
>> >
>>
Anonymous
June 28, 2005 5:24:35 AM

Archived from groups: microsoft.public.windowsxp.general (More info?)

Thank you. Do have any examples on how to apply security templates via
secedit or a link to a good white paper.
Nathan

"David Candy" wrote:

> What has GPO's got to do with it. secedit applies these templates. That is scriptable. But you need to check that it can fix what you did.
>
> --
> --------------------------------------------------------------------------------------------------
> http://webdiary.smh.com.au/archives/_comment/001075.htm...
> =================================================
> <ncasey@nospam.postalias> wrote in message news:7CAB89EF-085D-4E86-97A8-881CF73D99ED@microsoft.com...
> > Unfortunately the PC’s are still in a NT 4 Domain. I have no way of deploying
> > the security policy via gpo. I need to find a scriptable solution.
> > Thanks
> > Nathan
> >
> >
> > "David Candy" wrote:
> >
> >> Type Security Templates in Help and look at some predefined ones, esp Default.
> >>
> >> --
> >> --------------------------------------------------------------------------------------------------
> >> http://webdiary.smh.com.au/archives/_comment/001075.htm...
> >> =================================================
> >> <ncasey@nospam.postalias> wrote in message news:B4535D90-7A04-40F2-AD1F-08C3B7F318AC@microsoft.com...
> >> > The Desktop team in our department has been deploying PC’s with the C:\ drive
> >> > permissions changed. They thought it would be convenient for the user if
> >> > everyone had full control of the entire c:\ drive.
> >> > I now need to return the c:\ drive permissions back to winxp standard. If I
> >> > go the advances security tab for the c:\ drive and edit the permissions for
> >> > the “everyone� group and change the "Everyone" permission to:
> >> > Traverse Folder / Execute File
> >> > List folder / Read Data
> >> > Read Attributes
> >> > Read Extended Attributes
> >> > Read Permissions
> >> > I then Select “This Folder Only� in the “Apply onto� drop down menu.
> >> > Now the sub directories now longer inherit the “everyone� group permissions.
> >> >
> >> > Since I need this done on several hundred PC’s I have been testing
> >> > subinacl.exe
> >> > I ran the following command on a fresh winxp install to get a backup of the
> >> > default c:\ drive permissions:
> >> > subinacl /noverbose /output=c:\aclbackups.txt /file c:\
> >> >
> >> > I then ran “subinacl /playfile c:\aclbackups.txt� on a PC that had the c:\
> >> > permissions changed.
> >> > The command changed the c:\ permissions back to base winxp c:\ drive
> >> > permissions but the sub folders still had inherited the “everyone� group full
> >> > control. On the advanced permissions tab of a sub directory the “Inherited
> >> > From� section showed “Parent Object� instead of “C:\�
> >> >
> >> > Any ideas on how I can change the C:\ drive and sub directories back to
> >> > winxp base permissions would be greatly appreciated.
> >> > Thanks
> >> > Nathan
> >> >
> >>
>
Anonymous
June 28, 2005 12:23:05 PM

Archived from groups: microsoft.public.windowsxp.general (More info?)

It's all in help. I've never used it because I have never changed system permissions (well maybe on my computer not on a network). When I make changes like your IT dept I apply at the lowest level.

Syntax
secedit /configure /db FileName [/cfg FileName ] [/overwrite][/areas area1 area2...] [/log FileName] [/quiet]
--
--------------------------------------------------------------------------------------------------
http://webdiary.smh.com.au/archives/_comment/001075.htm...
=================================================

<ncasey@nospam.postalias> wrote in message news:38B671B2-80E2-4AE9-8F02-0065DB63ABF7@microsoft.com...
> Thank you. Do have any examples on how to apply security templates via
> secedit or a link to a good white paper.
> Nathan
>
> "David Candy" wrote:
>
>> What has GPO's got to do with it. secedit applies these templates. That is scriptable. But you need to check that it can fix what you did.
>>
>> --
>> --------------------------------------------------------------------------------------------------
>> http://webdiary.smh.com.au/archives/_comment/001075.htm...
>> =================================================
>> <ncasey@nospam.postalias> wrote in message news:7CAB89EF-085D-4E86-97A8-881CF73D99ED@microsoft.com...
>> > Unfortunately the PC’s are still in a NT 4 Domain. I have no way of deploying
>> > the security policy via gpo. I need to find a scriptable solution.
>> > Thanks
>> > Nathan
>> >
>> >
>> > "David Candy" wrote:
>> >
>> >> Type Security Templates in Help and look at some predefined ones, esp Default.
>> >>
>> >> --
>> >> --------------------------------------------------------------------------------------------------
>> >> http://webdiary.smh.com.au/archives/_comment/001075.htm...
>> >> =================================================
>> >> <ncasey@nospam.postalias> wrote in message news:B4535D90-7A04-40F2-AD1F-08C3B7F318AC@microsoft.com...
>> >> > The Desktop team in our department has been deploying PC’s with the C:\ drive
>> >> > permissions changed. They thought it would be convenient for the user if
>> >> > everyone had full control of the entire c:\ drive.
>> >> > I now need to return the c:\ drive permissions back to winxp standard. If I
>> >> > go the advances security tab for the c:\ drive and edit the permissions for
>> >> > the “everyone” group and change the "Everyone" permission to:
>> >> > Traverse Folder / Execute File
>> >> > List folder / Read Data
>> >> > Read Attributes
>> >> > Read Extended Attributes
>> >> > Read Permissions
>> >> > I then Select “This Folder Only” in the “Apply onto” drop down menu.
>> >> > Now the sub directories now longer inherit the “everyone” group permissions.
>> >> >
>> >> > Since I need this done on several hundred PC’s I have been testing
>> >> > subinacl.exe
>> >> > I ran the following command on a fresh winxp install to get a backup of the
>> >> > default c:\ drive permissions:
>> >> > subinacl /noverbose /output=c:\aclbackups.txt /file c:\
>> >> >
>> >> > I then ran “subinacl /playfile c:\aclbackups.txt” on a PC that had the c:\
>> >> > permissions changed.
>> >> > The command changed the c:\ permissions back to base winxp c:\ drive
>> >> > permissions but the sub folders still had inherited the “everyone” group full
>> >> > control. On the advanced permissions tab of a sub directory the “Inherited
>> >> > From” section showed “Parent Object” instead of “C:\”
>> >> >
>> >> > Any ideas on how I can change the C:\ drive and sub directories back to
>> >> > winxp base permissions would be greatly appreciated.
>> >> > Thanks
>> >> > Nathan
>> >> >
>> >>
>>
Anonymous
June 28, 2005 3:49:45 PM

Archived from groups: microsoft.public.windowsxp.general (More info?)

ncasey@nospam.postalias wrote:

> Thank you. Do have any examples on how to apply security templates
> via secedit or a link to a good white paper.
Hi,

How To Reset Security Settings Back to the Defaults
http://support.microsoft.com/?kbid=313222



--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.m...
!