Powershell might work so long as you have local admin rights to the system.  There are also some GPO tools as well.

Yep - these can all do it. If you don't have powershell, figure out what the ACL should look like, write out the icacls.exe command & variables, then save it in a batch file and script it out to the other boxes.

What OS(es) are involved? All W2K3?

If you're just trying to add:
psexec \\srvName icacls.exe D:\temp\* /grant user-name:(D,GR,X)

Obviously it will need a little tweaking w/ the switches but this should do you for a starter.

Since the SUBINACL is working fine...looking for proactive solutions via Group policy...ANy suggestions....

I have a few of these scripts in Powershell I posted to my blog at http://sentinel24.com/blog/?page_id=51 . One example recurses through a file structure and adds permissions for a user

(FYI - I use the long form for Powershell syntax when writing tutorials but you can make this much shorter using gci, gwmi, ft, etc)


Obviously this won't work for services, so how to accomplish the same thing?

First I want to enumerate services, but I want to sort based on startmode and name and suppress everything except for the service name. (no status or table headers for example)


I'm not 100% sure what you are hoping to accomplish here, but if you wanted to add an account entry for each of those you can combine the 2 scripts into something like


http://ss64.com/nt/subinacl.html has additional subinacl syntax and is what I used when writing the scripts at my blog.

*Edit* While my way is more fun (I am addicted to making Powershell 1 liners!), I'd suggest checking out ajohnson's suggestion as that's probably closer to what you are looking for.