Re: Confusion over IO (Inherit Only) ACE on Vista

Dear Jialiang Ge,

Regarding the question about Windows server adding

BUILTIN\Administrators:(F)

to new folders created by a member of the Administrators group. I did not mean to imply we were seeing a problem of inheritance failure. We are not seeing this problem. Your comment was:

"This setting ensures that administrators could have better chance to
full-control the folder, even if the folder does not inherit ACE from its parent."

I find this strange. I'd expect everything to be controlled by inheritance from the parent folders.

Thanks for the group policy tip, but I will leave it on default. I need everything to work as standard Windows.

Jialiang Ge [MSFT] wrote:
1. The adding of the BUILTIN\Administrators:(F) ACL to every sub-folder on Windows Server is done because inheritance might break, but it should not break in the first place!

I agree. I'm also interested in why some inheritances break on your side. Do your clients have the permission to set their folders or subfolders to not inherit from the parent object? Does the break happen to many folders or just few?

One thing I noticed while experimenting with this, is that if I set an inheritable ACE at the top of a big tree of folders and files, there's a long delay, and it seems the ACE has to be applied to every folder and file below the root? I find this odd, because I thought inheritance was supposed to solve the performance problems of having to apply the ACE all the way down the tree...

It is because the ACEs of every nodes/subnodes under the root are being reset to the new list. A simple & quick "inheritance" cannot solve the problem because some sub-nodes may be set to not inherit ACE from the parent object. The system needs to traverse every nodes, remove the "not inhert" settings, and set the new values.

In addition, I just replied to your another thread "Delete File - Bypass NTFS?", where you can find a solution to remove those folders without resetting their ACEs.

Have a very nice day!

Regards,
Jialiang Ge (jialge@xxxxxxxxxxxxxxxxxxxx, remove 'online.')
Microsoft Online Community Support

=================================================
Delighting our customers is our #1 priority. We welcome your comments and suggestions about how we can improve the support we provide to you. Please feel free to let my manager know what you think of the level of service provided. You can send feedback directly to my manager at: msdnmg@xxxxxxxxxxxxxx

This posting is provided "AS IS" with no warranties, and confers no rights.
=================================================




--
Gerry Hickman (London UK)
.

Relevant Pages

  • Re: Audit dept request
    ... If you need to rely on the inheritance for some folders but would like to ... explicit deny will override the permit that is inherited. ... at this level and sub folders with the exception of a few sub folders. ...
    (microsoft.public.windows.server.active_directory)
  • RE: File Migration - Inheritance
    ... Subject: File Migration - Inheritance ... As we copied the security for these folders after much of the data had ...
    (microsoft.public.windows.server.migration)
  • Re: File Migration - Inheritance
    ... Thanks Vincent. ... to set the perms on the files to the perms of the parent directory. ... Subject: File Migration - Inheritance ... As we copied the security for these folders after much of the data had ...
    (microsoft.public.windows.server.migration)
  • Re: File permissions
    ... minutes to take ownership and set attributes of all files in this folder. ... folders since that is what is causing the root problem. ... strip the block inheritance setting if ... and then let the inheritable permissions trickle in. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Read only attributes
    ... > I have just installed the windows server 2003 i am not able to share ... > the folders with clients all folders are going into read only ... The workstation service is up? ...
    (microsoft.public.windows.server.general)