RE: Easiest way of removing access permissions from folders?

From: Khimji (Khimji_at_discussions.microsoft.com)
Date: 01/11/05 

Date: Tue, 11 Jan 2005 08:37:12 -0800

Thanks Rebecca,

No, what has happened is when I ran the group migration wizard, I had
managed to create a group called `oldDomain Admin' and reference it to
`Domian Admins' in the win2k3.

Then when I ran the security Translation Wizard, it applied to all folders
in the network, the permission `NewDomain\oldDomain Admin' where there was
`OldDomain\Domain Admins' permissions.

I have since remapped the group 'Domain Admin' so it references 'Domain
Admins' instead of 'OldDomain Admin'.

I ran the Security Translation Wizard and it has applied `NewDomain\Domain
Admins' permission to the necessary folders.

The problem is that `OldDomain\Domain Admins' permission is still there in
the folders. I would like to remove `OldDomain\Domain Admins' permission from
any folder in the network that has it. There are thousands of folders in the
network and I don't know how many and which ones have it.

Is there a way to remove the permission without having to check every single
folder?

Kind Regards

Khimji

"Rebecca Chen [MSFT]" wrote:

> Hello,
>
> Do you mean you want to migrate file server from one domain to another? If
> so, you can use FSMT to achieve this goal:
>
> Try the File Server Migration Toolkit
> http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfsc.mspx
>
> Frequently Asked Questions About File Server Migration
> http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfst_faqs
> .mspx
>
> You can also use Robocopy or xcopy to copy folders to the new machine.
> Those command-line tool will retain the original permission.
>
> Robust File Copy Utility (RoboCopy) can provide time-efficient maintenance
> of mirror images of large folder trees on network servers separated by slow
> or unreliable wide area network (WAN) links.
>
> Please take a look at the followng article:
>
> Robocopy.exe: Robust File Copy Utility
> http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techre
> f/en-us/Default.asp?url=/Resources/Documentation/windowsserv/2003/all/techre
> f/en-us/robocopy.asp
>
> Any update, let us get in touch!
>
> Best regards,
>
> Rebecca Chen
>
> MCSE2000 MCDBA CCNA
>
>
> Microsoft Online Partner Support
> Get Secure! - www.microsoft.com/security
>
> =====================================================
>
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
>
> =====================================================
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>

Relevant Pages

  • RE: Easiest way of removing access permissions from folders?
    ... understand you plan to remove 'OldDomain\Domain Admins' permission on the ... 'OldDomain\Domain Admins' privilege from these folders? ... My opinion is to use subinacl command; however, you need to develop a batch ...
    (microsoft.public.windows.server.migration)
  • RE: Easiest way of removing access permissions from folders?
    ... P.S. Includes permissions of files as well as folders ... > understand you plan to remove 'OldDomain\Domain Admins' permission on the ... > 'OldDomain\Domain Admins' privilege from these folders? ... Use subinacl to query the shares replace the corresponding the ...
    (microsoft.public.windows.server.migration)
  • Re: Deny rights question
    ... There are some folders that they will be able to open by default on a domain ... membership in the domain admins, ... access the default hidden admin share on a domain controller such as C$, ... >I have a new 2003 environment that is managing some XP machines. ...
    (microsoft.public.windows.server.general)
  • Re: Deny rights question
    ... There are some folders that they will be able to open by default on a domain ... membership in the domain admins, ... access the default hidden admin share on a domain controller such as C$, ... >I have a new 2003 environment that is managing some XP machines. ...
    (microsoft.public.windows.server.security)
  • Re: Sharing privileged for standard users
    ... An administrator can share folders. ... Only the admins should have ... permission to do this, and shares should be created sensibly, not ... then the harass for admins to set shares for eahc computer for those ...
    (microsoft.public.windowsxp.security_admin)