Create Home Directories and Set NTFS Permissions with a Web Script

To make the script easier to read, I defined the custom constant of CUSTCON_ALLOW_INHERIT, whose sum represents these three flags. This custom constant configures the ACE so that the DACLs below the home directory inherit the ACE.

The AceType value specifies whether the ACE will have Allow or Deny type permissions. In the script, I use the ACETYPE_ACCESS_ALLOWED constant to specify Allow type permissions. In other words, the subdirectories below the user account's home directory will inherit the ACE and the user account will have Allow type permissions.

The oTrustee value specifies the trustee that you want to assign to the ACE. To assign a trustee to the ACE, the SetACE function needs the trustee's user-account name, domain name, and SID. The SetTrustee function neatly compartmentalizes the trustee information for the SetACE function.

The SetTrustee function takes four parameters: the moniker to the CIMv2 namespace and the trustee's domain name, user-account name, and SID. The script obtains the domain name from the Web form's User account domain text box and the user-account name from the form's User account name text box. The script obtains the SID from the QuerySid function that I described earlier. . . .

Awesome! But will it work on 'old' non Active Directory Win 2000 server?

sean August 28, 2001

The short answer is yes, with minor modifications it will work with a stand-alone computer running Windows 2000. You must change the QuerySid function so that it queries the SAM database on the stand-alone Windows 2000 computer rather than the Active Directory store on a domain controller. You might also have to modify the SetTrustee function because the domain name is one of its parameters.
Perhaps I could write a supplement to this article that shows the changes necessary to make this work on a stand-alone Windows 2000 computer.

Ethan Wilansky October 23, 2001

I tried putting the script into a Visual Basic component, which should not have presented any problems. However, when I try to set permission rights on the folder, I get an undefined automation error. My components run on the Web server, which is also the domain controller. However, the folders may be created on any file server within the domain. Can you tell me what the path to the folder should look like when passing it into the procedure? The path is always like this: 
 
\\SERVERNAME\Users\USERNAME 
 
where Users is a share that is located on the E: drive of the server. I have tried a few things, like 
 
\\SERVERNAME\Users$\USERNAME 
\\SERVERNAME\Users\USERNAME 
\\SERVERNAME\E:\Users\USERNAME 
 
If you can see why I get the undefined automation error, please let me know. I really need to be able to set security for the user on this folder, and I have not been able to find any other way to do it.

Inge Schepers December 05, 2001

How can I do this with multiple users? I took your script and hacked it into a VBScript file to run against a large volume of data. The problem is that I can only use one user and it overwrites the existing ACE entries for the ACL. This is the best script I have found to do this so far. I commend you on your knowledge. Thanks for any help. 
Braden - Thanks for your kind words about the article. I have to tell you, I really sweated that one out because, as you've found, the documentation on configuring DACLs using WMI is somewhat incomplete.
In answer to your first question, you should wrap the modifications to the DACL inside a script that uses either ADO and the ADSI OLE DB provider or a script that enumerates containers using the ADSI IADsContainer interface.
Here's a script that uses ADO to return all user accounts that are security principals in a domain named na.fabrikam.com. Once that result set is returned, the script modifies the company attribute of each user account to Fabrikam. What you need to do is replace the bolded lines of the script below with the script I wrote to modify the DACL of user account folders. Of course, you should also change the distinguishedName specified in the query string. I know this isn't a complete solution but hopefully it puts you on the right track. This script is part of the System Administration Scripting Guide (SASG) that I'm contributing to for the Windows .NET Server Resource Kit. To see this and many other scripts, visit: http://www.microsoft.com/technet/scriptcenter. This is the area that our team is responsible for and the scripts there are derived primarily from the scripts that will eventually appear in the SASG.
 
<pre>Set objConnection = CreateObject("ADODB.Connection") 
objConnection.Open "Provider=ADsDSOObject;" 
 
Set objCommand = CreateObject("ADODB.Command") 
objCommand.ActiveConnection = objConnection 
 
objCommand.CommandText = "LDAP://dc=NA,dc=fabrikam,dc=com;" & _ 
"(&(objectCategory=person)(objectClass=user));" & "ADsPath;subtree"
 
Set objRecordSet = objCommand.Execute 
 
While Not objRecordset.EOF 
strADsPath = objRecordset.Fields("ADsPath") 
Set objUser = GetObject(strADsPath) 
objUser.Put "company", "Fabrikam" 
objUser.SetInfo 
objRecordset.MoveNext 
Wend 
 
WScript.Echo objRecordSet.RecordCount & " user accounts modified." 
objConnect.Close</pre>
 
About not overwriting the DACL, I would have to research this before feeling comfortable with answering your question. Unfortunately, I'm swamped right now with trying to get chapters delivered for the SASG. I hope, though, that I've helped put you on the right track for now. I suggest visiting the TechNet Script Center to see what you can dig up. You might also want to download the latest WMI SDK and read about the Security Provider. --Ethan 

Braden Callahan August 28, 2002

Indeed this is the best script I've seen so far. But, one little tiny thing is missing....varType function is missing.

Remy March 29, 2004

The script is creating the users home directory but it si not giving it the necessary rights to the folder. The error I get is Unable to retrieve the Win32_LogicalFileSecurity Setting of d:\ririvera

RealBigTime November 04, 2004

I am a novice when it comes to ASP, so please bear with me. I have modified your UserCreate.asp and have it working fine, but when it comes to HomeFolderPerms.asp, the home directory on the file server is not created (although the script thinks it is) - until it tries to apply rights I have domain admin rights. I can run a test vbs script from the same directory on the domain server and create directories without a problem.

Anonymous User April 21, 2005 (Article Rating:

)

I am not able to find the entire scripts to download. Any idea. Thanks

Moongate May 24, 2006 (Article Rating:

)

You must log on before posting a comment.

If you don't have a username & password, please register now.