command-line-interfacescriptinguser-managementwindows-server-2008
as part of an installer I need to create a user with limited permissions
to add the user I will use
net user "<username>" <password> /add /fullname:"<username>"
I now need to explicitly add read and write permissions to a specific folder assigned for ftps for this user, how can this be done as part of a script that can be invoked by the installer? if at all possible I need to avoid adding additional dependencies like powerscript.
You can actually just grant the user the appropriate permissions directly on the images folder without giving them any permissions on the parent folder. The "Bypass traverse checking" user right will allow the user to traverse a set of folders to which they have no permissions to get to a folder to which they do have permissions. Note that the user will have to explicitly access the path to the images folder as they won't be able to browse to it.
From the "Bypass traverse checking" user right explanation:
Bypass traverse checking
This user right determines which users can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.
Default on workstations and servers:
Administrators Backup Operators Users Everyone Local Service Network Service
Default on domain controllers:
Administrators Authenticated Users Everyone Local Service Network Service Pre-Windows 2000 Compatible Access
Best Answer
ICACLS C:\FTPS_FOLDER /grant USERNAME:(OI)(CI)Mwill give you what you are after.