Some Issues With Security Permissions

hi all

i asked question in general forum , guys said me ask in here in order better help

http://social.technet.microsoft.com/forums/en-us/winservergen/thread/f8e12b8c-2cce-4fa8-bd6b-bf5f63d6d63a

i did admt previous domain new 1 , after had problems. thankful help.

my domain 2008 r2 1 way.

the problem security ntfs permission on file server hosts more 2 million files (about 2 tb of data)

we have 500 users different permissions on different files.

what gonna these :

1- many of permissions duplicated. example see john@olddomain.com twice in ace. remove them

2- permissions of previous domain there. except permission john@newdomain.com both seen in ace (john@newdomain.com , john@olddomain.com)

3- remove permissions assigned users disabled. (those wont return company related ace not needed).

4- there many ace entries users have been deleted ace looks s1-2324-***

i delete entry users deleted ad.

do need script these done or can them via windows server self.

by way ! have 2 file servers. 1 w2k3 sp2 , 1 win2k8r2 (and domain 2008 r2 told you)

thanks in advance

i found answer 4. seems subinacl can , utility named removeunknown not find

but other questions still without answer me

hello,

you can use setacl tool (also free tool). setacl created helge klein (mvp).

download link:

setacl: windows acl management

examples:

managing file system permissions setacl.exe

now problem, use command (example share folder):

setacl.exe -on "c:\share" -ot file -dom "n1:old-domain;da:remdom;w:sacl,dacl" -actn domain –rec cont_obj

quick description:

-on name of object

-ot data type (here: files , folders; setacl can registry, printers, etc.)

-dom refers activities domain related permissions

da:remdom removed permissions specified domain n1

-actn performs specified action

-recursion rec indicates child objects edited

for clear sidhistories, microsoft has vbscript, kb295758.

how use visual basic script clear sidhistory

you can use powershell , remove sidhistories.

how remove sid history powershell - ashley mcglone (msft)

as additional info, can use adfind with admod tool , clear sidhistories in domain. adfind & admod created joe richards (mvp).

clearing sidhistories in domain

regards

Windows Server  >  Directory Services