[kristiaa_d]

Hello,
Firstly i am new so please go easy with me

i am in the middle of setting up a Domain with AD running server 2003.

is there anyway i can give normal domain users access to specific folders under the program files folder

i can use Runas /user:administrator@source.local cacls "c:\program files\source software\" /P <username>:C from the command prompt of the PC but idealy i need this to happen silently on client login

i have tried using logon scripts todo this BUT it looks like the script runs with what ever privilages the user has so just doing cacls "c:\program files\source software" /P <username>:C fails as it does not have admin privialges....

is there a better way todo this OR some other way that will sort this problem out? also i need to modify the registry to allow certain keys to be written to as well can anyone suggest a way todo this.

Thanks
Kris

[netxt]

Hello Kris,

Since you have an AD infrastructure, you can use GPO to define folder and registry permissions.
Create a GPO, edit the File system and Registry sections from Security settings and link this GPO to the proper OU.

[kristiaa_d]

Hi netxt,
thanks for the information, i have tried both Scripts and GPO's and none of them are working. i have no reason why either.

i have tried login scripts but they run with local user privialges so i cannot do a Cacls as that requires admin authority, i tried a Startup Script as this runs as SYSTEM and gets all the privilages it wants, this also failed ( i assume ).

i also added a GPO to the OU the user is in and added the %program files%\Source software folder allowing all domain users full control of the folder and this appears not to have worked either. neither a reboot or logoff / logon attempt seems to make it work.

is there anyway i can find out why these are not running or not working i do not even know if the login / startup scripts are running and i cannot find any way to determine if they did.

server is windows 2003 standard running AD etc, service packed and all updated.

client PC's are all windows 2000 pro again all service packed and up to date.

[JeremyW]

Originally Posted by kristiaa_d

i also added a GPO to the OU the user is in and added the %program files%\Source software folder allowing all domain users full control of the folder and this appears not to have worked either. neither a reboot or logoff / logon attempt seems to make it work.

This is a computer setting so that means that the GPO needs to be linked to the OU containing the computer that the user will be logging on to.

[kristiaa_d]

WooHoo it works hehe

some may say that was a schoolboy error but i think its down to my brain not getting enough blood

ok thats working great BUT (and you knew there would be) i cannot get all the sub folders and files to inherit the permissions of the parent folder, any ideas on this one?

Thanks
kris

[Mikep]

Originally Posted by kristiaa_d

ok thats working great BUT (and you knew there would be) i cannot get all the sub folders and files to inherit the permissions of the parent folder, any ideas on this one?

Set the appropriate permissions on the parent folder and go into the Advanced Security Settings. Remove the inheritable permissions tickbox and tick the 'Replace' box to configure those permissions to propagate down to the sub folders and files. Any new files and folders will inherite the parent permissions.

[kristiaa_d]

Hi all,
thanks for the information, everything i needed todo is now working and i have made notes for future hehe. again thanks all much appreciated.

[danielp]

Thanks for sharing your answer with us! I'm sure others will also benefit from knowing what was wrong and how you fixed it.