ACL permissions in Windows 2000

From: Winguru (anonymous_at_discussions.microsoft.com)
Date: 03/25/04 

Date: Thu, 25 Mar 2004 04:56:11 -0800

Hi,

Could someone help me with the following :

I created a share folder and activated some user security on it and gived some users "Change" permissions.
What happens, that the users who have "Change" permissions, can change the security rights for other users if he creates a sub-folder. The users with "Change" permissions, could give "Deny" access to the administrator or even system account.
As we use some public folders, I don't want to run a script that take back the ownership of the folders or sub-folders, as I want to know who created the sub-folders, the take ownership would give me a wrong listing of the users who have created these new folders. So, I would like to know if it was possible to block the users who have "Change" permissions that they can activate the "Deny" access in the Security Tab !!!!!

Thanks all for you help...