Remove user permission out of User Object ACL 1

[xylax]

I need some help on removing an ACL from all user objects in my domain. I have a user that has 'send as' rights on every account in my domain. The rights are not propagating from the parent folder. Is there any script that can be run to remove that particular ACL from all the accounts in one swoop?

Shon
Network Administrator

 

[Kuskaya]

Some article regarding you issue

How to use Xcacls.vbs to modify NTFS permissions

http://support.microsoft.com/kb/825751/en-us

How to Use CACLS.EXE in a Batch File

http://support.microsoft.com/kb/135268

If you search with the keywords : "acl" and "modify" and "domain" I am sure will find something that can help you.

Regards,
Cengiz Kuskaya

 

[xylax]

Unfortunately, XCACLS only changes permissions and ACLs on NTFS Files and folders. I need something that can change permissions on all user accounts. To be more specific, I need the exact opposite of what the SetSendAsPermission.exe program does.

Shon
Network Administrator

 

[Kuskaya]

I think,

this is what you are looking for

How to Use Dsacls.exe in Windows Server 2003 and Windows 2000

http://support.microsoft.com/kb/281146

Dsacls.exe is a command-line tool that you can use to query the security attributes and to change permissions and security attributes of Active Directory objects. It is the command-line equivalent of the Security tab in the Windows Active Directory snap-in tools such as Active Directory Users and Computers and Active Directory Sites and Services.

Regards,
Cengiz Kuskaya