Windows Server – List Existing File Server Permission Groups/Users

Q1: Is there a way to restore at least read access to all files/folders to the Administrator account in a recursive fashion?

If permissions are inherited (ie. not set separately on different files and folders) then changing the permissions on the root folder and setting the "Replace all child object..." checkbox will replace all the permissions with inherited permissions.

This will of course replace permissions on child items that are supposed to have different permissions.

Q2: Is there a way to prevent users from removing Administrator from files/folders permissions on Windows Server 2003/2008?

No.

While there is a separate flag for "Change Permissions" Windows will ignored this for the owner of the file (the owner can always change the permissions), otherwise an empty ACL (or one with deny everyone everything ACE) wouldn't be reversible.

we can't even backup files manually as we get permission errors.

Why would you want such manual operations? Backup software should be run with and assert the backup (and on restore, the restore) privilege which will bypass ACLs. If the user needs to manually backup some part of their files that they own then they can easily copy.

Perhaps this is really an issue of user training: if you deny administrators access then administrators cannot help you with file management.

Would you accept to use powershell ? It could do the whole job, even avoiding the cygwin part.

The first way is to just do the loop through powershell:

$dirlist=Get-Content dirlist.txt
foreach ($dir in $dirlist)
{
    write-output "doing $dir"
    echo y | cacls "$dir" /T /C /G "Domain Admins":f "Some Group":f "some-security-group":f
}

Would leverage much more powershell by using it to change ACL:

$dirlist=Get-Content dirlist.txt
foreach ($dir in $dirlist)
{
  write-output "doing $dir"
  $acl=(get-item $dir).GetAccessControl()
  $colRights = [System.Security.AccessControl.FileSystemRights]::FullControl
  $InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::None
  $PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None 
  $objType =[System.Security.AccessControl.AccessControlType]::Allow 
  $objUser = New-Object System.Security.Principal.NTAccount("wingroup\kenmyer") 
  $objACE = New-Object System.Security.AccessControl.FileSystemAccessRule ($objUser, $colRights, $InheritanceFlag, $PropagationFlag, $objType) 
  $acl.AddAccessRule($objACE)
}

more detail can be found here: http://technet.microsoft.com/en-us/library/ff730951.aspx