Systems Management

The first thing to establish is whether this location is "hard-coded", or whether you can influence the log folder location somehow (registry, inifile, start-up folder, etc). Ideally, you should make the application create the files elsewhere - is it an in-house application?

As a last resort, you could grant users of that application special permissions to create new files in the windows folder (but not modify existing files), maybe using a group. But this should only be done as a last resort.

I can think of a complicated work-around using the installer service to create the next sequential log file at application runtime and modify it's ACL accordingly (and maybe delete redundant ones). This solution would rely on an advertised shortcut and the fact that your MSI might be "managed", but I won't go into details!

to create new files in the windows folder (but not modify existing files),

Hi Thanks a lot for the reply. The app has no registry, ini file configure info to coustomise this log file creation. It is an in-house application.

The workaround you suggested (to create next sequential log file at application runtime using installer service) is of no use as the app itself is creating the log file at runtime. If 1.log already exists, it creates 2.log. if 2.log exists then 3.log and so on.


Kind regards
Steevan

Make a startup script to remove the logfiles

Give permission to a few number of files log1, log2, log3, log5 from GPO etc.

that gives the ability to start the program say 5 times

But best thing is to change program behavior.

Sweede [;)]

ORIGINAL: Sweede



Make a startup script to remove the logfiles

Give permission to a few number of files log1, log2, log3, log5 from GPO etc.

that gives the ability to start the program say 5 times

But best thing is to change program behavior.

Sweede [;)]




Make sure that if you try to modify the permissions of the log files that the System account has modify permissions on the folder that the log files reside in.

You could easily create a Global group in AD and give users in that group create permissions in the Windows folder. This will mean that only those users with the app have that sort of permission. It's messy but it will work.

can we give permission using cacls to a create log files only in a folder

If I understand your post correctly, you are asking if you can use CACLS to restrict users in such a way that only log files can be create in a folder. A simple execution of CACLS with no arguments or reading of its documentation would show you all its command line arguments, none of which would implement such a feature.

I think the only way you could achieve what you want would be to create a service which watches the folder in question and deletes any file which isn't a log file. You would obviously also have to define, for that service the file types which you consider to be 'LOG' files.

Next, it's not really The Done Thing - here or in most forums I know of - to resurrect old threads.

Lastly, what exactly does your question have to do with 'Group Policy', the intended subject matter for this forum?