Change NTFS Permissions Across a WAN

Systems administrators frequently need to change permissions on files or directories. Administrators typically use Windows Explorer for this task; however, using Windows Explorer locally or through Windows 2000 Server Terminal Services to configure multiple directories on a remote server can be time-consuming. Terminal Services' Administrative mode, which limits you to two concurrent connections, makes the task even more difficult to accomplish quickly; moreover, using a GUI across a slow WAN link is almost impossible.

The Microsoft Windows NT Server 4.0 Resource Kit's command-line utility Xcacls (xcacls.exe) makes changing permissions easier. However, Xcacls is still difficult to use, and the administrator needs to input each directory or username as a separate command. (For more information about Xcacls, see the Microsoft article "Using the Command Line to Edit Multiple Subdirectory Permissions" at http://support.microsoft.com/?kbid=265360.)

My company recently needed to set explicit NTFS permissions on multiple users' directories on a remote server across a 64Kbps WAN frame relay connection. Using Terminal Services to connect to the server was extremely slow. Although using Xcacls was faster, the task still would have taken several hours because of the sheer number of users and the necessity to type commands repeatedly. As a result, we decided to use NT's command-shell script with the For command. (The For command is an iterator, which repeatedly executes—or iterates—another command.)

We used Notepad to create a text file that contained the required usernames. For example, suppose we needed to give Full Control to the Applications directory for the users Mary, Joann, and Mason, whose accounts resided in the domain Sirius. The text file would contain the usernames Mary, Joann, and Mason as a list. We would save the text file we created in the same directory as Xcacls and enter the following command at the command line:

For /f  %i in (Accounts.txt) do Xcacls Applications /T /G Sirius \%i:F /E

When you change permissions on directories, you must use the /T switch. The /T switch isn't necessary when you edit permissions on files. Wildcards are acceptable for files in a current directory. You can omit the domain name (e.g., Sirius) if the command runs in the same domain that Xcacls runs in.

To see a list of permissions, open a command prompt and enter

Xcacls help

The permission F stands for Full Control; R stands for READ.

Xcacls works only in the current directory. Unless you're using Terminal Services to take control of a remote computer's desktop, you must map the drive and enter the command from the directory on which you're setting permissions.