Xcacls and Incorrectly ordered permissions

[Kevin Gates]

Hi,

When I try to use Xcacls to set the permissions for a newly converted
NTFS drive, I am running into some problems.

If I do Xcacls D: /E /G "power users:F" /Y
I get permission for the root directory but the permissions don't seem
to automatically apply to pre-existing directories on the drive.

If I do Xcacls D: /E /T /G "Power Users:F" /Y
then it will apply explicitly to the entire drive ... not via
inheritance. also, when i look at the permissions for any
subdirectories of D, it gives me the "Incorrectly ordered permissions"
error message.

I've running Windows XP Pro SP1, i've tried this with the cacls that
ships, the xcacls that ships on the CD, and the Xcacls that is
downloadable from the Windows 2000 resource kit site. The only thing
that seems to work right is the SetACL program
(setacl.sourceforge.net) ... but I was hoping to stick to mainly
Microsoft utilities.

Anyone have any ideas (or know of any patches) that might fix xcacls?

thanks,

Kevin Gates

[Roger Abell [MVP]]

xcacls has a less than stellar recent history
If you use it make sure it is the most recent that can be=20
obtained from a search at microsoft.com/downloads

cacls is the thing to use with XP
I have not seen the cacls that ships with XP cause=20
misordered ACEs in the ACLs

What you report, about it not being applied except to=20
the root (and subdirs that do allow inheritance from it)=20
when used without the /t is exactly what you should=20
expect. Similarly with the /t you are saying to do this=20
explicitly on the subdirs recursively.

The default setup of the system boot drive is such that=20
almost everything below the drive root does not allow=20
inheritance of ACLs from the root. Thus, to make a=20
change to these you must touch them explicitly.

--=20
Roger=20

"Kevin Gates" > wrote in message =
...
> Hi,
>=20
> When I try to use Xcacls to set the permissions for a newly converted
> NTFS drive, I am running into some problems.
>=20
> If I do Xcacls D: /E /G "power users:F" /Y
> I get permission for the root directory but the permissions don't seem
> to automatically apply to pre-existing directories on the drive.
>=20
> If I do Xcacls D: /E /T /G "Power Users:F" /Y
> then it will apply explicitly to the entire drive ... not via
> inheritance. also, when i look at the permissions for any
> subdirectories of D, it gives me the "Incorrectly ordered permissions"
> error message.
>=20
> I've running Windows XP Pro SP1, i've tried this with the cacls that
> ships, the xcacls that ships on the CD, and the Xcacls that is
> downloadable from the Windows 2000 resource kit site. The only thing
> that seems to work right is the SetACL program
> (setacl.sourceforge.net) ... but I was hoping to stick to mainly
> Microsoft utilities.
>=20
> Anyone have any ideas (or know of any patches) that might fix xcacls?
>=20
> thanks,
>=20
> Kevin Gates