1

I am restructuring a messy Windows Server 2012 share that I have.

I want to use iCacls to write a .bat script so that I can set ntfs permissions to be as restrictive as possible, and then subsequently use this script to revert back to my pre-decided 'default' ntfs permissions structure in the case of other admins adding extra permissions etc over time.

I've read that iCacls will receive 'Access Denied' errors while setting permissions unless it's invoked by the owner of the file, so i've thought about using TAKEOWN driveletter: /R to take ownership of everything on the share.

Would I be opening up any security risks by changing ownership of everything to domainname\administrator ? I worry that it's a single point of failure or something to that affect.

4
  • Short answer: no, but you may break things. Some folders, such as home folders or profile folders will not work if their dedicated user is no longer owner.
    – LPChip
    Nov 8, 2017 at 13:10
  • Thank you for your answer @LPChip The share only contains documents really, there are no user profiles sitting on it. Only Files that need to be shared amongst groups. Once i'm careful to ensure that I don't remove anyones access to files they need I can proceed without opening any security risks so yes? Nov 8, 2017 at 13:22
  • Setting owner does not change security rights, so no security risk. Setting security rights does, but only towards those on the network. In order to manage files you do not really need to be owner, just be in a security group or added as security member with full access. But if you do not have that, then you won't be able to set ownership either. Do note, that you can always push rights from the bottom and set all permissions to inherit those. The best strategy would be to first announce that you work on it and people can't use those, then remove all permissions, and build from the ground up.
    – LPChip
    Nov 8, 2017 at 13:34
  • @LPChip Thanks for the advice! I think i'll do something along those lines! If you want to add your last comment as an answer i'll mark it as the accepted answer, appreciate it! Nov 9, 2017 at 14:07

1 Answer 1

0

Setting owner does not change security rights, so no security risk. Setting security rights does, but only towards those on the network. In order to manage files you do not really need to be owner, just be in a security group or added as security member with full access. But if you do not have that, then you won't be able to set ownership either. Do note, that you can always push rights from the bottom and set all permissions to inherit those. The best strategy would be to first announce that you work on it and people can't use those, then remove all permissions, and build from the ground up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.