Vista - NTFS Permissions via VBScripting

Good morning!

You will start to see a bit of me in the coming days and weeks as I am going
to be working on a major project of automating a ton of things at work.

All environments are Windows Server 2003. Nothing with Windows Server 2008
just yet.

Anyway, right now I have an immediate "need" for assistance. A client has
asked for essentially a user audit. He wants to know who has access to
what.

I can quickly get all of the share permissions for all of the shared folders
using the Resource Kit tool SRVCHECK. I am also able to get all of the NTFS
permissions via xcacls or showacls. However, the NTFS Permissions part of
this is problematic, simply from quantity of folders inside the share
folders.....

What I am looking to do is to create a VB script that will take care of
both. And, since this will be for a client, the output has to be "user
friendly".

I am not asking anyone to sit down and write this for me. I do not want
that at all.

I am having an issue on where to start! Again, there are already existing
tools that do both (Share permissions and NTFS permisisons...). It is
really the output of these existing tools. Thus, my thought process is to
create a generic VBScripting script that I can use in all environments that
we manage and customize the output of these scripts so that we can
effectively run the script, print the output and then turn it over to the
client.

Oh, my scripting expertise! I go to Richard Muellers' web site and 'steal'
his (naturally keeping his header in each script...I do give credit where
credit is due). I am able to modify things to fit the environment in which
the script is being run...so, I am not a complete 'blank slate'!

I used to be fairly decent in vbscripting, but it has been awhile.....

Thanks,

Cary

"Cary Shultz" <cshultz@xxxxxx> wrote in message
news:ucnKIhQaJHA.5108@xxxxxxxcacls.vbs might be a good starting point:
http://download.microsoft.com/downlo..._installer.exe

okay...so I spoke too soon.

I do have an idea.....

I can enumerate all of the shares on a server. I can specify "TYPE=0" so
that I avoid the print queues and the Administrative Shares. My issue is
what to do with this...

I think that I know the theory....get a collection of all the shares that
match "TYPE=0" and then run through each member of the collection and do
"something" with it. Output the results of that "something" and then move
on to the next member of the collection. Continue doing thids until I am at
the end of the collection.

I will work on this script but if you all could point me in the right
direction I would appreciate it. I will be looking at examples on the
Internet and Richard's web site. My concern is that I make this as
efficient as possible a script.

Thanks,

Cary
"Cary Shultz" <cshultz@xxxxxx> wrote in message
news:ucnKIhQaJHA.5108@xxxxxx

Pegasus,

I saw your many posts regarding xcacls and have started looking into it from
a scripting perspective. I should have mentioned that in one of my two
posts. Plus, I have used/liked xcacls/cacls for a really long time (since
1999 or so!). So, it was part of my thought-process.

Any idea on how to "tame" the output so that it is more user-friendly? This
is going to be one of the integral parts of the scripts that I write. Run
it, print it, hand it to the client....so-to-speak.

Thanks,

Cary

"Pegasus (MVP)" <I.can@xxxxxx> wrote in message
news:eD1LUvQaJHA.1336@xxxxxx

You have two options to get an output format to suit your requirements:
- Modify xcacls.exe. Since all screen output consists of
wscript.echo statements, this shouldn't be too hard, in spite
of the 4,300 lines of code.
- Massage the output with a script of your own. This would
be my preferred option if I wanted a very simple output.
Unfortunately it requires a second script file.


"Cary Shultz" <cshultz@xxxxxx> wrote in message
news:etlVtARaJHA.1528@xxxxxx

Pegasus,

4,300 lines of code vs. a good massage? I will take the second route!

Thanks,

Cary PS. I will probably be asking for some guidance once I start
this.

"Pegasus (MVP)" <I.can@xxxxxx> wrote in message
news:utuVVSTaJHA.4084@xxxxxx

Cary

I've recently been involved in a project to migrate/amalgamate a
number of servers including the rationalization of NTFS permissions
and security groups. One tool I found very useful was Dumpsec from
Somarsoft. It's free and well worth a look. Subject to how you
configure it, it will output reports on permissions to a variety of
file formats which can then be manipulated with vbscript, or any other
suitable language.

Regards

Ian