How to Set File Permissions with CACLS and Excel

Guy recommends:
VBScript Training Video on CD

A VBScript for Setting File Permissions with CACLS

This page features the second and third parts of our mission to create user's home folders and employ CACLS to set the permissions.

CACLS is a command-line program ideal for scripting bulk changes to folders permissions.  What makes this CACLS example difficult, but realistic, is that it also creates the users folders from data stored in an Excel Spreadsheet.

Topics for Creating Folders and Setting Permissions with CACLS

This page deals with Stage 2 and 3 creating the home folders and setting the permissions with CACLS.  If you are not familiar with CACLS, here is a refresher for CACLS switches.

• Our Mission and Goal
• Stage 1: Introduction to CACLS
• Stage 2: Creating the users (sub) folders
• Stage 3: Set the permissions with CACLS

Our Mission and Goal

To recap, our mission is to create home directories for users, then assign permissions with CACLS.  The typical structure on a file server would be a shared folder called home, then each user has their own folder as a sub-directory under home.

If you create users home folders with the Active Directory Users and Computers then you can invoke the %username% variable, which not only creates a folder named after the user, but also sets the permission to username full control.

The problem arises if you bulk create users with CSVDE or VBScript, in such cases I find that %username% does not work, so we need an alternative method to create the home folders and set the permissions - a job for CACLS.

As ever the secret of scripting is to build up in stages. 
Stage 1: Introduction to CACLS. Simple example to set folder permission to Administrators full control.
Stage 2: Create the users (sub) folders.  Assumption we have the usernames in a spreadsheet.
Stage 3: Set the permissions on each user's folder to username: f and administrators: f.  (f= full control)

Stage 2: Create the users (sub) folders

This stage relies on VBScript creating a FileSystemObject (objFSO), which can read the spreadsheet containing the usernames for the folders.  Once we have the objFSO, we pass the spreadsheet cell values to a variable called strUser.  The Do Until... Loop structure cycles through each cell, reading the usernames in the first column.

Stage 3: Set the permissions on the user's folder

VBScript uses a sub routine to create the folder with the correct name and importantly, set the correct permissions with CACLS commands.  What we want is for each user to have full control of only their own folder.  Administrators are also assigned full control, but to everyone's folder.  I have to admit that Stage 3 is an extension of Stage 1, both deal with setting the CACLS permissions.

Prerequisites

You must have a server with a shared folder.  This is a script that will execute equally well on a Windows server or an XP machine.  Should you get permission errors, I recommend that you logon as administrator.

Instructions for Creating your Cacls VBScript

1. Copy and paste the example script below into notepad or a VBScript editor.
2. Change the value for strHomeFolder, especially the server name.
3. Save the file with a .vbs extension, for example: Cacls.vbs 
4. Double click Cacls.vbs and check the permissions with Windows Explorer for strHomeFolder.

Sample Script to Set CACLS permissions

VBScript Tutorial - Learning Points

Note 1: This VBScript example creates a FileSystemObject controlled by objFSO.  This is a classic file object which we can manipulate to extract excel values from the spreadsheet.

Note 2: Cacls operates in a cmd prompt, therefore, the script creates a shell object objShell.  The Run command calls for comspec rather than cmd.exe.
objShell.Run("%COMSPEC% /c Echo Y.  Note the Echo Y to close the box.

Note 3:  The permissions section is controlled by:
& strHomeFolder & " /t /c /g Administrators:f "_
& strUser & ":F", 2, True)

strHomeFolder is the path we want to change the permissions.
/t means trash the existing permissions.  Remove all permissions and add those specified by /g.
(/c  Tells the script to continue if there is an error).
/g Administrators:F Sets the new permissions for Administrators with full control.  Observe how this command sets the users permission: & strUser & '"F:".  The point is that the /g has two qualifiers, the administrators and the strUser.

Note 4: This script contains two sets of error-correcting code, one caters for cases where the folder does not exist, the other section alerts you if VBScript cannot set the permissions.

Summary of Setting CACLS Permissions using Excel

Cacls is a command-line utility, which manipulates folder and file permissions.  It is particularly suited to scripting, Cacls is ideal for bulk changes to folder permissions, for example, users home folders.   This page gives you examples of reading from an Excel speadsheet.

Guy Thomas recommends Computer Training Software. 

Their topics and material are ideal for getting you started with VBScript.  The videos are easy to follow and you can control the pace.  Try their free demo material and then see if you want to buy the full package. See more about VB Script Training CD.

See Also

● CACLS   ● (Part 1) VBScript to Create Folders        ● WMI Examples