How to Back Up and Restore NTFS and Share Permissions


How to Back Up and Restore NTFS and Share Permissions

               One thing that has made the NTFS permissions piece of this simpler is the Icacls tool. Icacls was developed for Windows Vista as a replacement for tools such as Calls, Xcacls, and Xcacls.vbs. It was also included in Service Pack 2 for Windows Server 2003 and Windows Server 2008.

Backup and Restore of Share Permissions
To backup share permissions, export the Shares registry key.
  1. Open Regedit to the following location:

    HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares
  2. Right-click the Shares registry key and select Export. Give it a file name such as shareperms.reg.
When you want to restore the permissions, double-click shareperms.reg to import it back into the registry.
Use the Reg Jump tool to backup the registry key from the command line:
reg export HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares shareperms.reg
If you need to restore it at some point, just run:
reg import shareperms.reg
Backup and Restore of NTFS Permissions
Use this command to backup NTFS permissions:
icacls d:\data /save ntfsperms.txt /t /c
The /T switch allows it to get subfolder permissions too. The /C switch allows it to continue even if errors are encountered (although errors will still be displayed).
Use this command to restore them:
icacls d:\ /restore ntfsperms.txt
Note that in the command to save the permissions, I specified the target folder D:\Data, but when I restored them, I specified just D:\ as the target. Icacls is a little funky like that, and here’s why.
If you open the text file with the exported permissions (ntfsperms.txt in the above example), you’ll see that Icacls uses relative paths (in bold below). Underneath the relative paths are the permissions for the folders in Security Descriptor Definition Language (SDDL Jump ) format.
data
D:AI(A;ID;FA;;;BA)(A;OICIIOID;GA;;;BA)(A;ID;FA;;;SY)(A;OICIIOID;GA;;;SY)(A;OICIID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)(A;OICIIOID;SDGXGWGR;;;AU)
data\folder1
D:AI(A;ID;FA;;;BA)(A;OICIIOID;GA;;;BA)(A;ID;FA;;;SY)(A;OICIIOID;GA;;;SY)(A;OICIID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)(A;OICIIOID;SDGXGWGR;;;AU)
data\folder2
D:AI(A;ID;FA;;;BA)(A;OICIIOID;GA;;;BA)(A;ID;FA;;;SY)(A;OICIIOID;GA;;;SY)(A;OICIID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)(A;OICIIOID;SDGXGWGR;;;AU)

Had I specified D:\Data in the command to restore the permissions, it would have failed to look for a D:\Data\Data folder:
D:\>icacls d:\data /restore perms.txt
d:\data\data: The system cannot find the file specified.
Successfully processed 0 files; Failed processing 1 files

You might think to specify D:\ as the target in the restore command may somehow mess up the permissions on other folders at that level, but as you can see from the ntfsperms.txt output file, it only has information about the Data folder and subfolders, so that is all it will change.


Comments

Post a Comment

Popular posts from this blog

How to Enable Recycle Bin on Mapped drive.

Image
How to Enable Recycle Bin on Mapped Drive. Here is the solution for enabling Recycle Bin on Mapped Drive. I have tested it in My existing environment Windows Server 2019 and Windows Server 2012 and it's running fine.  Step 1. Press Win+R and type regedit and hit the enter key. Step 2. Goto " HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions " Step 3. Press Right Click on Mouse and Create New Key under FolderDescriptions and paste  " {9147E464-33A6-48E2-A3C9-361EFD417DEF} " as value. Step 4. After creating the key Right Click under  " {9147E464-33A6-48E2-A3C9-361EFD417DEF} " and Create New REG_DWORD-32Bit with Name = Category and set Value to 4. Step 5. Create New String with Name = RelativePath and set the value to Y:\  (Note: Replace volume letter Y with your existing letter. ) Step 6.  Create New String with Name = Name  and set the  value to YDrive Step 7. Goto " HKCU\Software\Microsoft\Windows\CurrentVersion\Exp...
Read more

How To Setup Internet Access Priority With Multiple Networks On Windows

Image
How To Setup Internet Access Priority With Multiple Networks On Windows If you are using multiple NIC's (Network Adapters) to access more than one network, it gets tricky from where you internet connection comes from. Here is one such scenario and solution to make Microsoft Windows prioritize internet connection from a particular network over the other. In my example setup I have one LAN connection (192.168.0.1) and one  WiFi  connection  (192.168.1.1) and would like Windows to use internet from my fixed-line broadband connected via LAN. To get started with configuring the internet access priority on your Windows computer, follow the steps below : Setup Network Card Priority at  Control Panel -> Network and Internet -> Network Connections -> Advanced menu –> Advanced settings . However, the above will not prioritize the internet access. To achieve that "Right-click on your  network  adapter " and click "Properties". Clic...
Read more

Fix: Documents Folder opens automatically at Windows Startup.

Image
Fix: Documents Folder opens automatically at Windows Startup Some often report this strange but quite annoying issue. While logging in to the computer, the Computer folder or the Documents folder opens automatically at Windows Startup . Unless you have placed its shortcut in the Startup folder, the most likely cause of this issue is the  incorrect or duplicated Usernit value in the Windows Registry. The fix for this problem does exists, but it requires modifying the registry. Serious problems might occur if you modify the registry incorrectly. Therefore, it is essential you follow these steps carefully. For added protection, back up the registry before you modify it or else create a  system restore point  first. Then, you can restore or revert if the changes are not what you expected. Documents folder opens automatically If when you start your  Windows 8  | 7, the This PC / Computer or Documents folder opens up automatically at start-up, first check...
Read more