Re: ACL permissions in Windows 2000

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 03/26/04 

Date: Fri, 26 Mar 2004 00:49:21 GMT

I have not actually dealt with that exact problem and am not sure if this will work,
but try removing the creator/owner group from the folder permissions in the advanced
page or restricting the permissions to that group which may help though if they know
how to take ownership then they still would be able to change permissions. Also give
your users/everyone no more than "modify" ntfs permissions which will not allow then
to change permissions based on that group membership. You can also use Group Policy
to remove the security tab from folders for users/groups as shown in KB below. ---
Steve

http://support.microsoft.com/default.aspx?scid=kb%3ben-us%3b303153

"Winguru" <anonymous@discussions.microsoft.com> wrote in message
news:5CE6E071-7CF8-4225-8C9B-B3BB9D51800E@microsoft.com...
> Hi,
>
> Could someone help me with the following :
>
> I created a share folder and activated some user security on it and gived some
users "Change" permissions.
> What happens, that the users who have "Change" permissions, can change the security
rights for other users if he creates a sub-folder. The users with "Change"
permissions, could give "Deny" access to the administrator or even system account.
> As we use some public folders, I don't want to run a script that take back the
ownership of the folders or sub-folders, as I want to know who created the
sub-folders, the take ownership would give me a wrong listing of the users who have
created these new folders. So, I would like to know if it was possible to block the
users who have "Change" permissions that they can activate the "Deny" access in the
Security Tab !!!!!
>
> Thanks all for you help...

Relevant Pages

  • Re: Admin cannot change folder permissions
    ... attributes like read-only are not permissions. ... Security tab within the Properties of an NTFS object ... The read-only checkbox on folders is only a switch ... > in admin tools/services when I started rps so I could ...
    (microsoft.public.windowsxp.security_admin)
  • Re: NTFS Security Question.
    ... A subordinate object DOES not inherit the PARENT perms (in ... will assume "Nebulous" permissions that refer to the LINK ... The trick is to PROPOGATE to all FILES (not Folders and Files - that would ... Since Windows 2000 deny NTFS permission does not work ...
    (microsoft.public.windowsxp.security_admin)
  • Re: File permissions on windows xp - home edition
    ... accessing the security tab on my NTFS System/OS partition I still can ... folders, because somehow the write prtoection is on for ALL these folders and ... I open to the security tab and changed the advanced security permissions for ... subfolders and files (i.e. ...
    (microsoft.public.windowsxp.security_admin)
  • RE: ISA 2004 REPORT FAILURE
    ... Did as you suggested and turned auditing on for the system and folders ... that is setting the wrong permissions of the folders ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • Re: access denied when explorring some items
    ... also, after ok'ing the advisory box, security tab views. ... You will need to change the permissions ... XP does not share the user profile folders. ...
    (microsoft.public.windowsxp.general)