Windows Advisor

File Permissions Thru Group Policy

Reader wants to make it easy to set file permissions on a folder.

Q: How can I set file permissions for a user on a folder using Group Policy in Windows Server 2003/2008?

A: You do it by configuring a Group Policy setting. That setting is located under Computer Configuration | Windows Settings | Security Settings | File System. Here's the procedure:

  1. Go to the location in the Group Policy listed above.
  2. Right-click File System.
  3. Click Add File.
  4. In the "Add a file or folder" window, select the folder (or file) for which you want the permissions to be set, and click OK.
  5. In the security box that pops up, you can add a user or a group that needs permission to the folder.
  6. You can also configure permission inheritance if you want. If you decide later to modify the permissions or inheritance, simply right-click the object in the right-hand pane and select Properties.

There's one thing to keep in mind: Although the path to the file or folder is, by default, pointing to the folders on the server, the path is relative to the client to whom this Group Policy will be applied. Simply type the path to the folder in the text box if you don't see the folder you need listed there.

About the Author

Zubair Alexander, MCSE, MCT, MCSA and Microsoft MVP is the founder of SeattlePro Enterprises, an IT training and consulting business. His experience covers a wide range of spectrum: trainer, consultant, systems administrator, security architect, network engineer, author, technical editor, college instructor and public speaker. Zubair holds more than 25 technical certifications and Bachelor of Science degrees in Aeronautics & Astronautics Engineering, Mathematics and Computer Information Systems. His Web site, www.techgalaxy.net, is dedicated to technical resources for IT professionals. Zubair may be reached at alexander@techgalaxy.net.

Reader Comments:

Mon, Oct 13, 2008 Darren Mar-Elia www.gpoguy.com

While you can do this through GP, I don't recommend it. It can be very expensive, from a processing perspective, to set file (or registry) permissions. If you use GP for this, keep in mind that security policy refreshes, whether it needs to or not, every 16 hours by default. That means that file permissions distributed through GP will reapply at least every 16 hours, if not more often. So you have to ask yourself, do you want to take the hit on target systems every time that happens, given that it could happen when the user least wants it or expects it. I think you are better off using a one-time script to do this rather than GP....

Add Your Comment Now:

Your Name:(optional)
Your Email:(optional)
Your Location:(optional)
Comment:
Please type the letters/numbers you see above