Richard Willis – SharePoint Learning Kit Coordinator, SalamanderSoft Owner

Richard,

This is great! I think I’m almost there. I ran the file through PowerShell and recieved the error below on all folders. Is there something else I need to change in the script?

You cannot call a method on a null-valued express
At D:\2011\brhs.ps1:5 char:210
+ if ($desktopIni -ne $null) { $Acl
ty.accesscontrol.filesystemaccessrule(“HS Student
$desktopIni.FullName $Acl }
+ CategoryInfo : InvalidOperation: (
+ FullyQualifiedErrorId : InvokeMethodOnNull

Richard,

I don’t often use PowerShell so forgive me if I am doing something wrong. I went back and edited the PowerShell file to be spaced out of the amount of lines you used above. I again ran the file and recieved this shorter message. It did not run and error on all files like it did previously. Is there something in the script I need to change?

Unexpected token ‘Ar’ in expression or statement.
At D:\2011\brhs.ps1:8 char:32
+ $desktopIni.FullName $Ar <<<< = New-Object
+ CategoryInfo : ParserError: (Ar:String) [], ParseException
+ FullyQualifiedErrorId : UnexpectedToken

i keep getting this error any ideas??

Set-Acl : The security identifier is not allowed to be the owner of this object.

I Keepp getting the security identifier error too. Has anyone resolved this?

Instead of using a script you could also just add an extra column to the view of windows explorer called “Filename”

“View”, “Choose Details…”, activate “Filename” and press “OK”

@Steve

I get the same error message. I am fairly certain that the user has to be owner of the folder for redirection to work.

What I did to fix the issue was to install FSRM and make a file screen for the share where their home directory is mapped disallowing any ini files. That did the trick for me.

If you’re denying access to an entire group, doesn’t that include the user you want to see it in many cases?

For example I have a “students” group, and all of the users are in that group. If I deny access to a file for the “students” group, that will include the user who I want to see it. What am I missing?

Nevermind, I see what MS is doing.. They assume the user is outside the group (in their example deny access for the admins group).

A fourth option is to add the ‘Filename’ column to your Windows Explorer view. Much easier then other options.

Steve :i keep getting this error any ideas??
Set-Acl : The security identifier is not allowed to be the owner of this object.

There are errors in this code because you are not allowed to do this if you are not the owner of the file/folder. Set-ACL also wants to write the owner even if you have not changed it or don’t want to change it. So you are getting that error because it is tring to change the owner. Instead try this which will use the GetAccessControl method to specify what part of the security description you want to read (and change)

Replace

$Acl = Get-Acl $desktopIni.FullName

With

$Acl = (Get-Item $desktopIni.FullName -Force).GetAccessControl(“Access”)

@Jay Hutter
This script may cause errors if you do what Microsoft say and apply it to administrators if you backup files or try to move them since you not can’t access the desktop.ini in these folders. Option #1 is what should be done on http://support.microsoft.com/kb/947222

We got the same problem on one of our servers.
I am working for a school board, and all the users home drives are set in the folder D:\users (D:\users\students, D:\users\staff, D:\users\admin staff)
This program is using xcacls.vbs
I wrote this vbs script and it’s working well on a 2003 server. Its well commented and you should not have any problems to follow my code.
This program runs from the command prompt with or without argument:
c:\: will run to the default folder hard coded in the program (defpath)
c\:\ d:\other users: will run on the folder d:\other users.

Here is the code (tested and working):

‘**********************************************************************************
‘* Bert, April 30 2011 *
‘* To prevent administration group to read desktop.ini inside a user Home Drive. *
‘* Reading desktop.ini prevents to display the right folder name *
‘*(ie: displaying My music, My Documents or My video in stead of the folder name) *
‘* Usage: At the cmd prompt > DRD.vbs *
‘* if no argument is passed, the default path (defpath) *
‘* will be selected to apply the restriction setup *
‘**********************************************************************************

Option Explicit
Dim strFolderToSearch, strfolder, WshShell, objRootFolder, objFolder, colSubfolders, strOutput, objFSO,_
strxcacls, arg, x, y, filesys, filetxt, defpath, usersarray()
Set Arg = Wscript.Arguments
x = 0
y = 1
Const ForReading = 1, ForWriting = 2, ForAppending = 8

‘++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
‘+ Begining of custom settings +
‘++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

‘**********************
‘* Location of xcacls *
‘**********************
strxcacls = “c:\xcacls.vbs”

‘******************************************************************************************
‘* Path for the default user’s folders (if no argument is passed from the command prompt) *
‘* This will be used when running as a scheduled task *
‘******************************************************************************************
Defpath = “D:\users”

‘+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
‘+ End of custom settings +
‘+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Set WshShell = WScript.CreateObject(“WScript.Shell”)
Set objFSO = CreateObject(“Scripting.FileSystemObject”)
Set filesys = CreateObject(“Scripting.FileSystemObject”)

‘Deleting the previous batch file
If filesys.FileExists(“c:\changeACL.bat”) Then
filesys.DeleteFile “c:\changeACL.bat”
End If

‘Creating the an empty batch file
Set filetxt = filesys.OpenTextFile(“c:\changeACL.bat”, ForAppending, True)

‘Checking if the user’s folder has been passed to the program.
‘If yes, take arg.item(0) as a folder to apply the permissions
‘if no use the default path (Defpath) defined earlier.
If Arg.count = 0 then
set objRootFolder = objFSO.GetFolder(Defpath)
Else
Set objRootFolder = objFSO.GetFolder(arg.item(0))
End If

set colsubfolders = objRootFolder.subfolders

‘Find Group folders under users folder and store it into an array
For each objfolder in colSubfolders
x = x + 1
ReDim Preserve usersarray(x)
usersarray(x)= objfolder
next

‘Find user’s folders for each group stored in the array,create the command line and copy it to a batch file.
for y = y to x
Set objRootFolder = objFSO.GetFolder(usersarray(y))
Set colSubfolders = objRootFolder.SubFolders

For Each objFolder in colSubfolders
strfolder = usersarray(y)& “\” & objfolder.name
‘********************************************************************************************************
‘* The following is copyied to changeACL.bat to remove the read right of the INI file *
‘* (/R user Revoke specified user’s access rights.) *
‘* here is an example: cscript c:\xcacls.vbs D:\users\admin staff\1adm\desktop.ini /D “Domain Admins”:R *
‘********************************************************************************************************
filetxt.WriteLine(strOutput & “cscript ” & strxcacls & ” ” & strfolder &_
“\desktop.ini /D ” &chr(34) & “Domain Admins” &chr(34) & “:R” & vbCrLf)
Next
next

filetxt.Close

‘Running the batch file to set restriction
WshShell.Run(“c:\changeACL.bat”),1,True
‘If an argument was passed to the command line, tell the user that the process ended successfully
if Arg.count > 0 then
Wscript.echo “User’s folders located in ” & objRootFolder & ” have been successfuly processed”
End If

Have never used powershell before but copied and pasted the scipt into a ps1 file. Changed the word groupName to StaffTemp which is the group I made to test this (the staff want to know whos documents relate to each user) then I ran powershell as an administrator, did “Set-ExecutionPolicy RemoteSigned”, located the ps1 folder which I had placed in the root of where all the Documents folders were and ran it by running .\scipt.ps1
It just went to the next line and nothing haappened! no desktop.ini file was changed. Help! What am I doing wrong?
Thanks

I love powershell and the issue can be resolved by using it but I solved it by using a simple batch file.

Just add a logon script (.bat) on the GPO that you used for folder redirection:

%windir%\system32\icacls.exe %homedrive%\Desktop.ini /deny “Domain Admins”:r

For further information see:

http://salfischberger.blogspot.com/2011/09/homedirectory-naamprobleem-na.html

It’s in dutch, but the screenshot should say it all

Denying Domain admins could have a negative effect on processors such as backup routines which rely on admin accounts to access files and folders.

We worked around the problem by initally replacing all the desktop.ini files with empty copys. The permissions of these files were then changed to deny write access to the user thus leaving all higher level admin permissions intact.

Would setting the desktop.ini files in all the directories to blank, and then setting them as Read Only do the trick?