Re: Default Permissions

From: Roger Abell [MVP] (mvpNoSpam_at_asu.edu)
Date: 12/23/04 

Date: Thu, 23 Dec 2004 14:50:05 -0700

When you look at the generalized view in the ACL editor you see only
ACEs that have flags set so that it will apply to
"This folder, subfolders, and files"
When you look using the advanced view you see all ACEs in the ACL
(at least for NTFS objects).
Users has a grant of read/execute that is a generic read, for this
folder (where the ACL is), subfolders and files. This means it is
inherited on down to anywhere within that does not block inheritance.
The other two ACEs that you see grant folder only permissions, and
carry no permissions on the contained files.
One allows Users members to create new folders in the folder with
the ACL (at the root of the drive if we speak of a new partition), and
the other allows Users members to create new files within subfolders
of the one holding the ACL.
Once a Users group member has exercised these abilities to create
a new object, then the generic grant to Creator Owner allows that
account to have full control over what it has created.

For many purposes these are rather reasonable settings, but for
others they are not. Remember defaults are just that, defaults.
It is not possible to prescribe something that is correct for all
circumstances. If you feel you have different needs, then yes, you
are supposed to set the ACLing to fit your needs. However, be
very careful that you understand what you are doing when you
modify the ACLing on the boot partition (the one containing the
Windows directory). 

-- 
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCDBA,  MCSE W2k3+W2k+Nt4
"Jarno" <Jarno@discussions.microsoft.com> wrote in message 
news:7957D368-D179-424E-AE61-6FE83C058BC6@microsoft.com...
> Hi!
>
> Can someone explain why the default permissions in every harddrives and
> partitions in Windows 2003 Server look like they do? For example if you 
> look
> at advanced settings on security the "Users" group will appear with three
> different settings. And what is the reason to put the "System" group 
> there.
> We feel like we want to remove all the default security and only leave the
> Administrators as default with full control and then add the permission we
> need in the subfolders.

Relevant Pages

  • Re: Want to turn permission propagation off in SetNamedSecurityInfo . . .
    ... The ACL and ACEs were pretty easy to parse, ... The object-specific ACEs are a bit weird and I ... determining the exact algorithms used to propagate the permissions. ... SE_FILE_OBJECT, read the dacl, then deleted any ACEs from the DACL ...
    (microsoft.public.platformsdk.security)
  • Re: How can I control folder permissions when creating a folder
    ... I'll dig into the ACL stuff a bit more. ... get into it was the idea of trying to figure out what permissions to add (do ... To answer your question about the folder creation. ... quite certain they were all created by an Admin account and they still have ...
    (microsoft.public.dotnet.security)
  • Re: Windows shared folder not respecting NTFS filesystem permissions?
    ... When I share a folder with a certain permission, I expect that permission to be respected underneath of it? ... "From an administrator point of view, ACL inheritance simplifies access control management. ... Mysteriously, on our SBS 2003 install, the underlying NTFS ACL seems to be being ignored, and once a share ACL gives write access to a folder, it gives write access to *every* file, even if the NTFS file permissions are explicitly set to provide read access only. ...
    (microsoft.public.windows.server.sbs)
  • Re: Cannot Send Email to Exchange 2003 Public Folders
    ... I had a look at the ACL permission too, forcing more rights than the users ... about a brand new Exchange 2003 installation. ... > someone's been fooling around with permissions from windows explorer. ... > that's controlling access to the folder. ...
    (microsoft.public.exchange.admin)
  • Re: Permissions again
    ... report the function error codes, standard rights flags, ... cases due to the odd way that Windows reads ACEs ... If I create a folder under Program files, for the folder I gell all permissions with your code and mine. ...
    (microsoft.public.vb.general.discussion)
Loading