using ICACLS.EXE

I am working on a project for our corporate email signature.  we purchased the exclaimer signature manager exchange edition and the outlook edition.  i have the exchange edition working, but my user base wants to see the signature in outlook otherwise they feel that it is not sending. i have tried explaining it to them but its no use.  So we are using the outlook edition to push that same signature from exchange edition to the endpoints. My problem is we are currently using outlook 2010 and even though the outlook edition signature is being pushed down to the endpoints, they still have the ability to create a new signature and set it as the new message and reply forward.  i have tried using the admx files and setting the option in there to disable that functionality which works, except then it blocks/removes the signature i want as the default signature from being used. 

So my plan B is to set the folder permissions of %appdata%\Microsoft\signatures and all subfolders/files to be:

domain admins - full

authenticated users - read/execute

system - full

network service - full

i tried using the file security option  under computer configuration for a GPO but it doesnt work or i am not seeing how i can use the %appdata% variable to set those permissions since each users signature resides in their specific appdata folder in their profile. 

i thought about using icacls.exe. can i push out icacls bye copying out that application to each endpoint and run a mini batch file to handle setting the permissions above which would prevent them from creating a new signature at least?

Is there some other way people are doing this or something similar? i would love a GPO way but so far i have been unsuccessful finding one that will work. 


March 27th, 2015 9:10pm

Hi xchangepatewon,

With Icacls.exe command line ,we can easily check and modify the acls of specific folder .

Here is a link for reference of using the Icacls command line .
Icacls
https://technet.microsoft.com/en-us/library/cc753525.aspx?f=255&MSPPError=-2147217396

Considering there are many user profiles and the path to the folder may vary .I am not quite sure it can be made from a batch file .

Best regards

Free Windows Admin Tool Kit Click here and download it now
March 30th, 2015 6:31am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics