0

I'm trying to use icacls to adjust permissions on a remote folder, when the grantee is the local group of the remote server. From machine Foo, I'm trying to grant modify rights for group Bar\Users to a folder on machine Bar. Executing it all on Bar is not really an option.

When I do

icacls \\bar\Share\Path /grant bar\Users:M

I get the following error:

bar\Users: No mapping between account names and security IDs was done. Successfully processed 0 files; Failed processing 1 files

If I quote the group name, like this:

icacls \\bar\Share\Path /grant bar\"Users":M

I get a different message:

bar"Users: The trust relationship between the primary domain and the trusted domain failed. Successfully processed 0 files; Failed processing 1 files

Any ideas, please? The account I'm doing it under has admin rights on both foo and bar. Both foo and bar are Windows Server 2008 machines on the same domain, neither is a domain controller.

Seva Alekseyev
  • 197
  • 2
  • 12

1 Answers1

0

If you really are trying to grant access for the Users group, then just drop the "bar\" and grant it to Users. Internally, it will convert to the SID locally on foo and then grant access to that SID. The Users group is a "Common Account" where the SID is the same everywhere.

Update: From the comments below, this will work if the above does not:

icacls \bar\Share\Path /grant *S-1-5-32-545:M

Change will be visible as a Special Permissions in Advanced security properties.

Zach Bolinger
  • 304
  • 1
  • 6
  • I've tried that. The ACL on the folder says foo\Users, which is not what I'm after. – Seva Alekseyev Apr 30 '15 at 15:41
  • I tested it before posting and it works for me. I'm using 2008 R2, though. Can you try adding it by SID? icacls \\bar\Share\Path /grant S-1-5-32-545:M – Zach Bolinger Apr 30 '15 at 16:00
  • I know you said you don't want to execute it on Bar, but can you view it on Bar just to make sure the group name is not resolving locally if you view it on Foo? – Zach Bolinger Apr 30 '15 at 16:04
  • 2
    Added as "Special permissions". You need to prefix the numeric SID with * : /grant *S-1-5... – Seva Alekseyev Apr 30 '15 at 16:10