Setting File Permissions Inside SVS Layers

Have you ever wondered if you can set file permissions in an SVS layer?

So for instance, you wish to auto-activate all layers, but want the group "users" to have read rights, and the group "advanced users" to have read rights?

In a normal XP or Vista environment you probably don't need this. But in a Terminal server environment this can be very useful.

Let's look at an example.

You have a terminal server running with DVS4SBC to get it compliant. On this terminal server you have Office virtualized, and you have Visio virtualised.

Visio adds a button to Excel and Word that users can click to start Visio. Even if they have no rights to start Visio, they will be able to start Visio. But you only want to let users with access to Visio, use it.

In SVS you will not be able to add directory rigths or NTFS rights. Even if you add it to the capturing process it will not be exported to other machines.

So how can you set things up so that a user with Visio rights can see the "launch Visio" button and a user without rights cannot see the button?

First of all.

THIS SCRIPT IS INTENDED FOR ADVANCED SVS ADMINS ONLY. IF YOU DO NOT FEEL COMFORTABLE WITH ADMIN TASKS, PLEASE DO NOT USE THIS. I will not be responsible for damage that occurs for misuse of this kind of scripting as Altiris will also not be responsible.

Go to the www.microsoft.com, and download the program Filemon. This great tool will show you what file is responsible for the button. And because you are on the Microsoft site, also download xcacls.exe

Start Word, and make sure filemon is running. Click on the Visio button, and look in Filemon what file is responsible for the start of Visio. Make a note of this file, you need this file/path later.

Create a group SVS-Visio-Users in your Active Directory. Feel free to add some users to this group.

And now let's work some magic. The script is written in two languages. If it fails on the name of a group, it will automatically go again in English.

Take the script below, and save it as permissions.vbs

REM Set File/Folder Permissions

NET LOCALGROUP SVS-Visio-Users
IF ERRORLEVEL=1 GOTO ENG

:NL
Cacls.exe "[Plaats hier het pad naar de folder waar het bestand zich in bevind die je wilt gebruiken zonder de brackets]" /T /E /P SVS-Visio-Users:F
GOTO END

:ENG
Cacls.exe "C:\[Place here the path to the folder where the file is in you wish to protect]" /T /E /P Users:F

:END

Now make sure xcacls is in c: windows/system32.

All you need to do now is to make sure that when you activate the program the script runs.

You can do this by using a post activate. A postactivate runs after the layer is activated.
Use the following line:

cscript permissions.vbs "[path to filenae you wish to protect without the brackets]" /T /G SID#S-1-5-32-545:R"

So let's explain what happens when you use that.

• CScript is the standard scripting tool included in all Microsoft Windows versions after 2000.
• Permissions is the vbs script you created before.
• /T and /g are commands from CScript. /G adds the permissions to the file. If you replace /G for /E, the existing permissions are taken of. DO NOT use /E ON CITRIX ENVIRONMENTS. It will stop the file from working completely.
• SID#S-1-5-32-545:R This is the general SID all users can use. In realtime it is replaced with the correct user ID.

And now we will have to face one problem.

After running this script it will prevent SVS from taking the file back inside the layer. If you deactivate or delete the layer, the file will still exist and you have to delete it manually by running the command line with the administrators group instead of the svs-visio-users group.

So what is the best way to do this?

Do not set rights on the c:\program files\application name directory, but set rights on the [_B_]PROGRAMFILES[_E_]

Now rights will be set if the application is activated.

When you export the package the rights will not be in the package. They get lost in the export process. Best way to ensure that the rights are taken inside the package is to set a post activate. The rigths are set after the package is activated.

Regards
ErikW
www.dvs4sbc.com