Question : Active directory hell

I'm trying to modify the permissions of a file server on Windows 2003. My knowledge is very limited but must be a 100 times better than the previous administrator.

I'm at a point where I don't understand why I can't do basic change to permissions.

The Domain Users group mostly had access to the entire structure. Since I understand that you cannot remove a domain user from this group, I'm trying to remove it from every permissions and use alternative group.  At one time, I tried to change the domain user group to another group.  

Now I see the Domain Users group in about every subfolder, and when I try to remove it, it says : "this permission is inherited"  But it clearly isn't, because I can't see it in the parent object properties. The only way I've found to remove it is to uncheck "Allow inheritable permissions from the parent to propagate...", and then delete it. but I must do it again for every subfolders ; it is going to take ages. Using the "Replace permission entries on all child objects.." mostly have no effect.

I don't know if i'm clear - let me try to put it simply: A permission I have removed from the root of a drive, keeps appearing as inherited in the permissions of the drive's subfolders.

thanks for your help.

Answer : Active directory hell

CACLS

The above command can change file permissions on lots of folders in one go.

http://www.computerperformance.co.uk/w2k3/utilities/cacls.htm

 

Greg