파일을 보호하기 위해서는 암호화를 하거나 비밀번호를 거는 방법등 여러가지 방법이 있지만 그중 가장 간단한것은 파일이나 폴더의 권한설정(NTFS)을 변경하는것입니다.
파일이나 폴더의 권한설정을 변경하는 방법은 대걔 탐색기를 이용한 방법을 사용하거나 cacls.exe 파일을 이용합니다. 하지만 탐색기와는 달리 cacls.exe 파일을 이용해서 탐색기처럼 자세한 설정을 할수는 없습니다.
간단한 예를 들어보면 특정폴더에 읽기 권한을 주고 싶다고 할경우 다음과 같이 설정을 하면 됩니다.
하지만 cacls.exe 파일의 경우 탐색기의 고급처럼 자세한 설정을 할수가 없습니다. 탐색기의 간단한 권한설정메뉴인 모든권한, 읽기, 쓰기, 바꾸기(쓰기) 가 전부입니다.
CACLS.EXE 옵션 보고
파일의 액세스 제어 목록(ACLs)을 화면에 표시하거나 수정합니다.
CACLS 파일 이름 [/T] [/E] [/C] [/G사용자:perm] [/R 사용자 [...]] [/P사용자:perm [...]] [/D 사용자 [...]]
파일 이름 지정된 파일의 ACLs를 화면에 표시합니다.
/T 현재 디렉터리와 모든 하위 디렉터리에서 지정한
파일을 찾아서 ACLs를 바꿉니다.
/E ACL을 대체하지 않고 편집합니다.
/C 오류를 무시하고 ACLs를 계속 바꿉니다.
/G 사용자:perm 지정된 사용자의 사용 권한을 부여합니다.
Perm은 다음과 같습니다:
R 읽기
W 쓰기
C 바꾸기(쓰기)
F 모든 권한
/R 사용자 지정된 사용자의 사용 권한을 철회합니다.
/P 사용자:perm 지정된 사용자의 사용 권한을 바꿉니다.
Perm은 다음과 같습니다:
N 없음
R 읽기
W 쓰기
C 바꾸기(쓰기)
F 모든 권한
/D 사용자 지정된 사용자의 액세스를 거부합니다.
한 명령에 하나 이상의 파일을 지정하는 대표 문자를 사용할 수 있습니다.
한 명령에 하나 이상의 사용자를 지정할 수 있습니다.
하지만 이러한 폴더가 한두군데가 아니라면.. 정말 큰일입니다.
이러한 경우에는 다음과 같은 스크립트를 이용하면 쉽게 처리할수 있습니다.
XCACLS.VBS 옵션보기
Microsoft (R) Windows Script Host 버전 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
Starting XCACLS.VBS (Version: 5.2) Script at 2008-02-18 오후 1:45:40
Startup directory:
"D:\tmp"
Arguments Used:
Filename is required and was not passed as an argument.
------------------------------------------------------------------
---------------------------- Usage -------------------------------
------------------------------------------------------------------
Displays or modifies access control lists (ACLs) of files & directories
XCACLS filename [/E] [/G user:perm;spec] [...] [/R user [...]]
[/F] [/S] [/T]
[/P user:perm;spec [...]] [/D user:perm;spec] [...]
[/O user] [/I ENABLE/COPY/REMOVE] [/N
[/L filename] [/Q] [/DEBUG]
filename [Required] If used alone, it Displays ACLs.
(Filename can be a filename, directory name or
wildcard characters and can include the entire
path. If path is missing, its assumed to be
under the current directory.
Notes:
- Put filename in quotes if it has spaces or
special characters such as &, $, #, etc.
- If Filename is a directory, all files and
sub directories under it will NOT be changed
unless the /F or /S is present.
/F [Used with Directory or Wildcard] This will change all
files under the inputed directory but will NOT
traverse sub directories unless /T is also present.
If filename is a directory, and /F is not used, no
files will be touched.
/S [Used with Directory or Wildcard] This will change all
sub folders under the inputed directory but will NOT
traverse sub directories unless /T is also present.
If filename is a directory, and /S is not used, no
sub directories will be touched.
/T [Used only with a Directory] Traverses each
subdirectory and makes the same changes.
This switch will traverse directories only if the
filename is a directory or is using wildcards.
/E Edit ACL instead of replacing it.
/G user:GUI Grant security permissions similar to Windows GUI
standard (non-advanced) choices.
/G user:Perm;Spec Grant specified user access rights.
(/G adds to existing rights for user)
User: If User has spaces in it, surround it in Quotes
If User contains #machine#, it will replace
#machine# with the actual machine name if its a
non-domain controller, and replace it with the
actual domain name if it is a domain controller.
New to 3.0: User can be a string representing
the actual SID, but MUST be lead by SID#
Example: SID#S-1-5-21-2127521184-160...
(SID string shown has been shortened)
(If any user has SID# then globaly all
matches must match the SID (not name)
so if your intention is to apply changes
to all accounts that match Domain\User
then do not specify SID# as one of the
users)
GUI: Is for standard rights and can be:
Permissions...
F Full control
M Modify
X read & eXecute
L List folder contents
R Read
W Write
Note: If a ; is present, this will be considered
a Perm;Spec parameter pair
Perm: Is for "Files Only" and can be:
Permissions...
F Full control
M Modify
X read & eXecute
R Read
W Write
Advanced...
E Synchronize
D Take Ownership
C Change Permissions
B Read Permissions
A Delete
9 Write Attributes
8 Read Attributes
7 Delete Subfolders and Files
6 Traverse Folder / Execute File
5 Write Extended Attributes
4 Read Extended Attributes
3 Create Folders / Append Data
2 Create Files / Write Data
1 List Folder / Read Data
Spec is for "Folder and Subfolders only" and has the
same choices as Perm.
/R user Revoke specified user's access rights.
(Will remove any Allowed or Denied ACL's for user)
/P user:GUI Replace security permissions similiar to standard choices
/P user:perm;spec Replace specified user's access rights.
For access right specification see /G option
(/P acts like /G if there are no rights set for user)
/D user:GUI Deny security permissions similiar to standard choices.
/D user:perm;spec Deny specified user access rights.
For access right specification see /G option
(/D adds to existing rights for user)
/O user Change the Ownership to this user or group.
/I switch Inheritance flag, if omitted default is to not touch
Inherited ACL's. Switch can be:
ENABLE - This will turn on the Inheritance Flag if
its not on already.
COPY - This will turn off the Inheritance flag and
copy the Inherited ACL's
into Effecive ACL's
REMOVE - This will turn off the Inheritance flag and
will not copy the Inherited
ACL's, this is the opposite of ENABLE
If switch is not present, /I will be ignored and
Inherited ACL's will remain untouched.
/SPEC switch Special Permission for Folder and Subfolders only
If this switch is used, and the object is a folder, then
one of the switches below would be used instead of the
default.
A - This Folder Only
B - This Folder, Subfolders and Files (Default)
C - This Folder and Subfolders
D - This Folder and Files
E - Subfolders and Files Only
F - Subfolders Only
G - Files Only
/L filename Filename for Logging. This can include a path name
if the file isn't under the current directory.
File will be appended to, or created if it doesn't
exit. Must be Text file if it exists or error will occur.
If filename is obmitted the default name of XCACLS will
be used.
/Q Turn on Quiet mode, its off by default.
If its turned on, there will be no display to the screen.
/DEBUG Turn on Debug mode, its off by default.
If its turned on, there will be more information
displayed and/or logged. Information will show
Sub/Function Enterand Exit as well as other important
information.
/TIMEWMI Turn on to Time WMI use, only shows up in Debug Mode.
/SERVER servername Enter a remote server to run script against.
/USER username Enter Username to impersonate for Remote Connections
(Requires PASS switch)
- Will be ignored if its for a Local Connection.
/PASS password Enter Password to go with USER switch
(Requires USER switch)
Wildcards can be used to specify more than one file in a command.
Such as:
* Any string of zero or more characters
? Any single character
You can specify more than one user in a command.
You can combine access rights.
Operation Complete
Elapsed Time: 0.015625 seconds.
Ending Script at 2008-02-18 오후 1:45:40
1. c:\test 폴더에 everyone 사용자가 모든권한을 사용하게 한다.
XCACLS.vbs c:\test /E /G everyone:F
2. c:\test 폴더에 대해서 파일을 읽을수만 있게 한다.
XCACLS.vbs c:\test /E /P everyone:X
3. c:\test 폴더내의 하위폴더와 파일를 만들수는 있지만 삭제할수는 없게 한다.
XCACLS.vbs c:\test /E /P everyone:X /D everyone:A7
참조
Xcacls.vbs를 사용하여 NTFS 권한을 수정하는 방법
