| Author |
Message |
Khimji
Guest
|
 Posted:
Fri Jan 07, 2005 5:37 pm Post subject:
Easiest way of removing access permissions from folders? |
|
|
I setup a win2k3 server and migrated users and groups from NT4. Both are in a
trust relationship and running.
There are permissions which have been applied to various folders while I was
doing the migration which I would like to remove.
Is there an easy way (or tools) of removing permissions without going to
every folder, e.g. I would like to remove userA from every folder that the
user has access permission to.
Thank You in advance.
Kind Regards
Khimji |
|
| Back to top |
|
 |
Rebecca Chen [MSFT]
Guest
|
| Posted:
Mon Jan 10, 2005 9:35 am Post subject:
RE: Easiest way of removing access permissions from folders? |
|
|
Hello,
Do you mean you want to migrate file server from one domain to another? If
so, you can use FSMT to achieve this goal:
Try the File Server Migration Toolkit
http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfsc.mspx
Frequently Asked Questions About File Server Migration
http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfst_faqs
.mspx
You can also use Robocopy or xcopy to copy folders to the new machine.
Those command-line tool will retain the original permission.
Robust File Copy Utility (RoboCopy) can provide time-efficient maintenance
of mirror images of large folder trees on network servers separated by slow
or unreliable wide area network (WAN) links.
Please take a look at the followng article:
Robocopy.exe: Robust File Copy Utility
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techre
f/en-us/Default.asp?url=/Resources/Documentation/windowsserv/2003/all/techre
f/en-us/robocopy.asp
Any update, let us get in touch!
Best regards,
Rebecca Chen
MCSE2000 MCDBA CCNA
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights. |
|
| Back to top |
|
|
Khimji
Guest
|
| Posted:
Tue Jan 11, 2005 10:37 pm Post subject:
RE: Easiest way of removing access permissions from folders? |
|
|
Thanks Rebecca,
No, what has happened is when I ran the group migration wizard, I had
managed to create a group called `oldDomain Admin' and reference it to
`Domian Admins' in the win2k3.
Then when I ran the security Translation Wizard, it applied to all folders
in the network, the permission `NewDomain\oldDomain Admin' where there was
`OldDomain\Domain Admins' permissions.
I have since remapped the group 'Domain Admin' so it references 'Domain
Admins' instead of 'OldDomain Admin'.
I ran the Security Translation Wizard and it has applied `NewDomain\Domain
Admins' permission to the necessary folders.
The problem is that `OldDomain\Domain Admins' permission is still there in
the folders. I would like to remove `OldDomain\Domain Admins' permission from
any folder in the network that has it. There are thousands of folders in the
network and I don't know how many and which ones have it.
Is there a way to remove the permission without having to check every single
folder?
Kind Regards
Khimji
"Rebecca Chen [MSFT]" wrote:
| Quote: | Hello,
Do you mean you want to migrate file server from one domain to another? If
so, you can use FSMT to achieve this goal:
Try the File Server Migration Toolkit
http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfsc.mspx
Frequently Asked Questions About File Server Migration
http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfst_faqs
.mspx
You can also use Robocopy or xcopy to copy folders to the new machine.
Those command-line tool will retain the original permission.
Robust File Copy Utility (RoboCopy) can provide time-efficient maintenance
of mirror images of large folder trees on network servers separated by slow
or unreliable wide area network (WAN) links.
Please take a look at the followng article:
Robocopy.exe: Robust File Copy Utility
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techre
f/en-us/Default.asp?url=/Resources/Documentation/windowsserv/2003/all/techre
f/en-us/robocopy.asp
Any update, let us get in touch!
Best regards,
Rebecca Chen
MCSE2000 MCDBA CCNA
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
|
|
|
| Back to top |
|
|
Rebecca Chen [MSFT]
Guest
|
| Posted:
Wed Jan 12, 2005 4:58 pm Post subject:
RE: Easiest way of removing access permissions from folders? |
|
|
Hi Khimji,
Frankly, I am not quite caught your mapping process. However, I do
understand you plan to remove 'OldDomain\Domain Admins' permission on the
existing folders. Is there any particular reason to remove
'OldDomain\Domain Admins' privilege from these folders?
My opinion is to use subinacl command; however, you need to develop a batch
file to achieve this goal. The steps are like follows:
1. Get the "OldDomain\Domain Admins" 's SID.
2. Use subinacl to query the shares replace the corresponding the
permission.
Such as:
subinacl /file C:\*.* /replace=DOMAIN1\USER1=DOMAIN2\USER2
For more details about subinacl syntax, please refer to the following
article:
SubInACL Examples
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techre
f/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/all/techre
f/en-us/subinacl_examples.asp
3. Repeat the steps to all folders.
HTH!
Best regards,
Rebecca Chen
MCSE2000 MCDBA CCNA
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights. |
|
| Back to top |
|
|
Khimji
Guest
|
| Posted:
Wed Jan 12, 2005 7:21 pm Post subject:
RE: Easiest way of removing access permissions from folders? |
|
|
Rebecca,
Sorry, I seem to have confused myself. I want to remove 'NewDomain\OldDomain
Admins' not 'OldDomain\Domain Admins'.
I want to remove 'NewDomain\OldDomain Admins' because I have deleted the
group from win2k3, but that has not removed the permission from the folders.
I know that with the permission there it will not do anything but I would
like to keep the folders tidy regarding permissions.
Would I be able to use the subinacl command to just remove permissions from
folders?
Sorry for confusing you and thank you for your help.
Kind Regards
Khimji
"Rebecca Chen [MSFT]" wrote:
| Quote: | Hi Khimji,
Frankly, I am not quite caught your mapping process. However, I do
understand you plan to remove 'OldDomain\Domain Admins' permission on the
existing folders. Is there any particular reason to remove
'OldDomain\Domain Admins' privilege from these folders?
My opinion is to use subinacl command; however, you need to develop a batch
file to achieve this goal. The steps are like follows:
1. Get the "OldDomain\Domain Admins" 's SID.
2. Use subinacl to query the shares replace the corresponding the
permission.
Such as:
subinacl /file C:\*.* /replace=DOMAIN1\USER1=DOMAIN2\USER2
For more details about subinacl syntax, please refer to the following
article:
SubInACL Examples
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techre
f/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/all/techre
f/en-us/subinacl_examples.asp
3. Repeat the steps to all folders.
HTH!
Best regards,
Rebecca Chen
MCSE2000 MCDBA CCNA
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
|
|
|
| Back to top |
|
|
Khimji
Guest
|
| Posted:
Thu Jan 13, 2005 3:59 pm Post subject:
RE: Easiest way of removing access permissions from folders? |
|
|
P.S. Includes permissions of files as well as folders
"Rebecca Chen [MSFT]" wrote:
| Quote: | Hi Khimji,
Frankly, I am not quite caught your mapping process. However, I do
understand you plan to remove 'OldDomain\Domain Admins' permission on the
existing folders. Is there any particular reason to remove
'OldDomain\Domain Admins' privilege from these folders?
My opinion is to use subinacl command; however, you need to develop a batch
file to achieve this goal. The steps are like follows:
1. Get the "OldDomain\Domain Admins" 's SID.
2. Use subinacl to query the shares replace the corresponding the
permission.
Such as:
subinacl /file C:\*.* /replace=DOMAIN1\USER1=DOMAIN2\USER2
For more details about subinacl syntax, please refer to the following
article:
SubInACL Examples
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techre
f/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/all/techre
f/en-us/subinacl_examples.asp
3. Repeat the steps to all folders.
HTH!
Best regards,
Rebecca Chen
MCSE2000 MCDBA CCNA
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
|
|
|
| Back to top |
|
|
|
|
|
|
FAQ
Memberlist
Register
Profile
Log in to check your private messages
Log in