Home folder permissions for VirusScan

[mattmsudawg]

I have a delima: We have some users that have files in their home folders that are recognized as viruses/spyware. The problem is because of the permissions set on their folder (the user is the only one that has rights to the folder) VirusScan cannot perform any actions on the file. I was curious as to if anyone else as had this problem and what has been done to fix it. Changing the permissions on all the folders is not an option as we have over 1000 user folders. Thanks in advance!!

 

[vbernardo]

mattmsudawg, I know that you said that changing the permissions is not an option. But have You tried the CACLS from NT Resource kit? It will make It very fast and easy to change a lot of permissions. First thing I do is to generate a text file with the folder names, and then I shove it all on excell where i mount the full command line. After that you just export it to a batch file, and thats It.

 

[mattmsudawg]

Thanks for the response vbernardo. I think we are going to try this. One other question though: If you have done this what permissions have you given to the home folders? The way we have it set up now only the user that owns the folder has rights to it. What user would we give rights so that VirusScan can perform actions on the folder?

 

[vbernardo]

Well mattmsudawg, what we did on those folder is a combination of three different accounts:

User Account - Should have a Change access (prevents the user from messing with acess)
Helpdesk Group - Domain Global group on which all helpdesk IT personel have Full Control Access (used to support)
Domain Admin - Also Full Control Access (usually we put here Backup service accounts and such as)

The Antivirus service account could be a member of any of those two last groups. I usually make that a Domain Admin. But you can make It a Helpdesk member instead if you like to avoid giving to much power to this account.

Regards,

VBernardo

 

[P3dr0]

We have many viruscan versions on many windows OS, and i never encountered this problem.
Is there some files in the folder of all files in the folder which are recognised as viruses/spyware ?
If its some, i think it's not a permission problem.
Did you check the filenames on NAI web site ?

 

[mattmsudawg]

Only some of the files in the user's home folders are being detected as adware/spyware. And it is most definately a permissions problem b/c in the description of the event it says moved failed and delete failed. We have since changed the permissions and it has been taken care of.