Re: NTFS folder permissions - Creator Owner issue (I think)


"F Laufs" <FLaufs@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:266F5017-7818-439A-A60A-7D9B3498BBE3@xxxxxxxxxxxxxxxx
> Roger,
>
> Thank you very much for your help.
>
> You're saying that this group can change permissions even when not
> expressly
> granted the permission to change permissions or denied it, but I have
> never

No, that is not what I said.
I said that the owner of an object can change the object's permission
whether the owner is (directly or indirectly) granted that permissions or
even whether explicitly denied that permissions.
I did not state this about the Creator Owner "group" but about the Owner.

> read this anywhere, and can't seem to find any documentation on it on the
> net. (I do believe you as I have seen the results!) I'd like to read up
> on
> the rights that this group has that I am not aware of.
>

It is not really a group, although it appears like one.
Creator Owner is a placeholder. You will find its use is normally set
to inherit onto contained/child objects. When a new object is created
the grant to Creator Owner becomes a real grant to the creator or the
permissions stated with the Creator Owner grant on the container.
The account that creates the object does become owner, and does
have the rights of an owner, not matter what is or is not granted with
the use of Creator Owner.

> We would really like to prevent users changing the permissions on folders
> because they tend to lock themselves and IT support out of them. Do you
> know
> of any method of doing this?
>

You must take away ownership and then the NTFS security permissions
will control their actions. While they own (as they do of anything they
create)
you can only hinder, not prevent.


> "Roger Abell [MVP]" wrote:
>
>>
>> "F Laufs" <FLaufs@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
>> news:77E028E8-8366-4069-A32A-F71710489B04@xxxxxxxxxxxxxxxx
>> > Hi all,
>> >
>> > I need to set up the permissions on a folder so that:
>> >
>> > For users in Group 1:
>> > Anyone can create a file or subfolder.
>> > Anyone can edit any file.
>> > Anyone can copy and paste any file or subfolder.
>> > Only the owner can, delete, rename or move a file or folder
>> > Anyone can view permissions
>> > Noone can change permissions or take ownership
>> >
>>
>> I doubt that that combination can be attained.
>> The issue is in that some files are changed by use of a temp
>> file that is renamed with the original deleted.
>>
>> > For users in Group 2:
>> > They can create, edit, copy and paste, delete, rename or move any file
>> > or folder, and view permissions.
>> > They can not changer permissions or take ownership
>> >
>> > For Group 1, I ticked R&E, List, R and W in basic settings, and then
>> > added
>> > a
>> > Creator Owner group to which I gave modify rights. This got me pretty
>> > close
>> > to what I need, except:
>> >
>> > (1) when trying to move a file or folder, an error message appears as
>> > expected for the file, but the folder error message says '...cannot
>> > copy...'
>> > and then copies just the folder. I suppose it doesn't actually move it
>> > but
>> > this will be confusing for the users
>> >
>> > (2) test user can change the permissions on own folders, definitely
>> > what I
>> > don't want. (On checking the advanced permissions it explicitly shows
>> > that
>> > change permissions is NOT ticked)
>>
>> The owner can always change permissions even when they are not
>> granted the permission to change permissions or denied it. Think of
>> the permission to change permissions as something only important
>> for non-owners.
>>
>> >
>> > For permission set 2 I was thinking of giving Modify permissions but,
>> > again,
>> > this allows users to change permissions on their own folders.
>> >
>>
>> It is not the Modify grant that allows this but being owner that does.
>>
>> > I wonder if there is a simple explanation?
>> >
>> > Regards
>> >
>> > Fiona Laufs
>> >
>>
>>
>>


.

Relevant Pages

  • Re: Dont Administrators have access to everything?
    ... folder, which the Limited users getaccess to. ... One of the Administrators is the Owner of nearly every ... the few that can be opened, but I thought the Administrators ... If you're an admin and you take ownership, and you replace permissions, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Lets talk about ownership!
    ... They will have the same permissions but the permissions are meaningless as there is no user to match. ... According my previous example the user "Terry" has read/write permissions on folder NickData. ... Ownership doesn't really matter as long as you have permissions. ... XP can be configured in Local Security Policy to make the Admin group the owner for files created by admins. ...
    (microsoft.public.windowsxp.general)
  • Re: Managing Security Groups as Distribution Lists
    ... then you wouldn't have to worry about setting any permissions at ... allow them to manage the security groups. ... > Each folder on my file server have folder owner and 3 corresponded groups ... > checking with the owner of the folder what permission to give him, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Previous Contacts
    ... no user is listed as owner in the permissions tab. ... To try out I added my account as owner on Contacts folder but problem still ... > Please do not contact me directly, only reply within the Newsgroup ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: Permissions between two users on same box?
    ... > be created as owned by the owner of the folder, ... permissions of the folder with the expectation that newly created files ... Change one's umask and hope the desired apps don't ...
    (comp.sys.mac.system)