Adding EVERYONE/FULL to all NTFS permissions

[Quiver318]

Hello, All.

A group in my company needs to backup user profiles on workstations before those workstations are reloaded with Windows. It is pretty easy to do this in the GUI by taking ownership of the profiles, and then adding the EVERYONE group to all folders/files with full permissions. I have been attempting to do this with a batch file, but it does not work as expected.

The command below should grant (and replace) the EVERYONE group on all files/folders and subfolders, and then add FULL permissions to the group. The command is run within the USERS folder, and let I it recurse the directories below updating the ACLs. After the routine ends and I check the permissions, the EVERYONE group is there, but the permissions are not added. They are blank.

icacls * /t /grant:r everyone:f

Could someone point me in the right direction to make this command work correctly beneath USERS? I am running this command on Windows 7 against external hard drives that can vary by OS (Vista, XP, or 7).

Thanks,

Q

[Lord Orwell]

just curious... did you open your command prompt with administrator permission?

[Quiver318]

just curious... did you open your command prompt with administrator permission?

Hello Lord Orwell!

I am sorry I did not notice this posting had arrived. To answer your question, yes I am using the Administrator command prompt.

Since my previous posting, I have experimented with Powershell scripting as well, but those experiments have yielded the same results of the newly added Everyone group appearing, but without permissions. It seems to happen on any directory structure I try to alter, and not just the Users (Profiles) folder. I have tried this on a few Windows 7 machines.

If you would like to experiment, create a test folder and drop a few files and folders into it. Then open an Administrator command prompt within your test directory, and run the command I posted. When it completes, open Windows Explorer and right-click on a test folder and look at the security tab. You will see EVERYONE has appeared, but it will have no permissions listed. You can add them from within the GUI, but for some reason they are not appearing with the command line.

Am I doing something incorrectly?

[Lord Orwell]

it's quite possible that this is an effort by microsoft to close some security holes. Good luck. have you considered writing something in vb?

[Quiver318]

it's quite possible that this is an effort by microsoft to close some security holes. Good luck. have you considered writing something in vb?

No, I have not made a VB tool to do this although I have tried with Powershell which uses similar methods.

Seems that CACLS (the tool prior to ICACLS) changed permissions differently because I don't remember a problem doing this with Windows 2000. I must be using ICACLS incorrectly.

Thanks for the reply!