Scrunched Permissions

This has been a bad week. On Monday, one of my 3 servers died (hardware error - freezing intermittently). So I spent 24 hours porting all services off it onto my other 2 servers.

Then, overnight, one of those two servers had a major conniption.

I have no idea what the cause was, and I've never seen anything like it. All I know is that the server did a reboot as part of Automatic Windows Updates. And when it came back on, all of the NTFS permissions were borked.

And I mean really borked.

A *lot* of files had mysteriously lost their "Inherit Permissions" setting, so were now sitting there with only the owner allowed to access them.

This server now houses ALL websites, so the net result is that most websites were down as the files weren't readable by the NETWORK SERVICE account (used by ASP) or IUSR_XXXX (used by plain vanilla IIS).

In all, there were a squillion files on the system, and their permission settings were now all over the place. I tried just going to the PERMISSIONS tab of the root folder and setting its permissions, but it then sat there for 2 hours - presumably setting all child folders - but I was getting nervous as I was now waiting a long time for nothing to happen, whilst most sites were down.

The slow but fairly sure solution came in the form of xcacls.exe and xcacls.vbs - tools provided by Microsoft. xcacls.vbs particularly is VERY slow but seems to do the job.

I was able to run the following at the command prompt in order to get the current folder and all subfolders, and all files contained therein, to inherit their parent's permissions:

xcacls.vbs . /f /t /i enable

There's a caveat to that, though, which is that it didn't work on many folders as we didn't have permission - because those folders were owned by a small FTP user and I was logged in as Admin. So some tweaking was required.

I wounder up opening 6 command windows and having 6 instances run at once.

Whenever I met a folder that needed to have its permissions reset at the command prompt without using the Windows UI (which could mean waiting for a very long time), I'd run:

xcacls . /G Administrators:F
xcacls . /G System:F /E
xcacls . /G iusr_XXXXX:R /E
xcacls . /G "NETWORK SERVICE":R /E

Where XXXXX is the name of my server. That cleared the permissions for that folder alone.

What a headache. A *lot* of crawling ahead, but it seems under control now, so I can go and do other work... any work I can find that doesn't involve using any of the sites that are still down :(