Re: Security and Permissions

From: jmos (jmos_at_discussions.microsoft.com)
Date: 08/05/04 

Date: Thu, 5 Aug 2004 03:51:03 -0700

I've found another post which states that what I'm looking for can be done.

Subject: Re: Permissions on Shared Files 7/16/2004 9:30 AM PST
By: Keith Langmead

In actuality I have had this work in the past but since I've added a couple
of other shares to the network and tried to simplify securities (explain
below) poeple now have access to everything which gets me wondering if there
is a corruption somewhere.

Everything else looks fine and the Event viewer shows exceptionally clean
logs. Nothing else seems to be effected.

Most other shares are working correctly and they are mapped to local drives.

My simplification of securities was to add all project security groups to
one large group to manage the share and ntfs permissions easily otherwise I
could spend hours just ensuring permissions were correct.

Is there anything else I could do or look into to solve this issue. I use a
test user to test the securities out and the only groups they are members of
are:

Domain Users -> primary
Group 1 -> Sub Folder Group

Share Group -> By implication of Group 1 being a member of Share Group.

This is exactly the same as in other shares which works well. However
something has gone wrong somewhere in setting up new shares and everyone has
access to all data regardless of the permissions I set.

Note all Shares are on the same volume.

Please Help

TIA

"jmos" wrote:

> Yes,
> What's happening is that in the case of both Joe and Mary
> they have access to all the sub folders in the share and
> that's what I do not want. They shoud only have access to
> certain sub folders in the share but generally have access
> to the share i.e to get to the sub folders.
>
>
>
> >-----Original Message-----
> >At first glance it looks as if you are doing everything
> correct. Are you saying that
> >Joe and Mary can access the data and write and delete
> files in all the subfolders or
> >what kind of access are they getting to them that you
> find unexpected? --- Steve
> >
> >"jmos" <anonymous@discussions.microsoft.com> wrote in
> message
> >news:03e801c47a74$622c1e30$a601280a@phx.gbl...
> >> Thank you Steven
> >> Yes I am including the NTFS Permissions.
> >>
> >> What I'm doing is this:
> >>
> >> 1. Create a group (Share Group) and and GP 1-3 to it.
> >>
> >> Share Permissions -> Domain Admin -> Full Control
> >> -> Share Group -> Change
> >>
> >> Share NTFS -> Domain Admin -> Full Control
> >> -> Share Group -> Modify (Special)
> >>
> >> Share Sub folders no Inheritance
> >>
> >> Share Sub Folder 1-> Domain Admin -> Full Control
> >> NTFS -> Group1 -> Modify (Special)
> >>
> >> Share Sub Folder 2-> Domain Admin -> Full Control
> >> NTFS -> Group2 -> Modify (Special)
> >>
> >> Share Sub Folder 3-> Domain Admin -> Full Control
> >> NTFS -> Group3 -> Modify (Special)
> >>
> >> User Joe appears only in Group1
> >> User Mary appears in Group 1 and 3
> >>
> >> Now my understanding is that for user Joe they would get
> >> the most restrictive of both the Share and the NTFS of
> the
> >> share AND that the NTFS of the Sub Folder overrides the
> >> securities of the forementioned i.e only access to Share
> >> Sub folder 1. The same would apply to User Mary i.e
> access
> >> to only Sub Folders 1 and 3 not 2.
> >>
> >> Am I right in saying this?
> >>
> >> If so why is this not currently working in my domain and
> >> what else should I do or be looking for?
> >>
> >> Many thanks for your reply
> >>
> >> JMOS
> >>
> >>
> >> >-----Original Message-----
> >> >Are you configuring ntfs permissions also? You also
> might
> >> try to use three top shares
> >> >instead as SB1, SB2, and SB3. However you do it, give
> >> system and administrators full
> >> >control ntfs permissions and then add the appropriate
> >> user group with the needed ntfs
> >> >permissions to each folder. If you are sharing one top
> >> folder then give
> >> >administrators full control and users change
> permissions
> >> to the share. If you use
> >> >three top shares then give administrators full control
> >> and the appropriate group
> >> >change control to each folder. Ntfs permissions are in
> a
> >> folders properties/security
> >> >page. When you test results be sure to logon as a user
> >> and not as an administrator
> >> >and log off and back on after a change to share or ntfs
> >> permissions. For a network
> >> >users, their permission to a share will be the most
> >> restrictive of either the share
> >> >or ntfs permissions. The link below may help. ---
> Steve
> >> >
> >> >http://support.microsoft.com/default.aspx?kbid=300691
> >> >
> >> >"jmos" <anonymous@discussions.microsoft.com> wrote in
> >> message
> >> >news:c31101c47a3a$5130eff0$a301280a@phx.gbl...
> >> >> Can some explain (simply) how Share, folder and sub
> >> folder
> >> >> permissions work because evrything I do in my domain
> >> >> simply does not work?
> >> >>
> >> >> All users have access to everything regardless of
> what
> >> >> permissions I set.
> >> >>
> >> >> I leave the network for up to and hour, log on as a
> test
> >> >> user and they still have access to everthing even
> >> though I
> >> >> specify access to only a select no. of shares.
> >> >>
> >> >> Currently I have a share - SHARE A with Subfolders
> SB1-
> >> >> SB3.
> >> >>
> >> >> Each SB folder is a project which only a select few
> can
> >> >> have access to.
> >> >>
> >> >> If I have groups GP1 -3 for each SB folder what
> >> >> permissions should I have for:
> >> >>
> >> >> 1. the Share
> >> >> 2. the Share folder (Security)
> >> >> 3. the SB folders in the share.
> >> >>
> >> >> Hope someone can help.
> >> >>
> >> >> TIA.
> >> >
> >> >
> >> >.
> >> >
> >
> >
> >.
> >
>

Relevant Pages

  • Re: Security and Permissions
    ... Most other shares are working correctly and they are mapped to local drives. ... My simplification of securities was to add all project security groups to ... could spend hours just ensuring permissions were correct. ... > certain sub folders in the share but generally have access ...
    (microsoft.public.win2000.security)
  • Re: removing user from domain users group doesnt help
    ... What I would do is to give that global group deny access this computer from ... only access shares on that server. ... give that group deny permissions for other shares on that server. ...
    (microsoft.public.windows.server.security)
  • Re: removing user from domain users group doesnt help
    ... user permissions to any shares and instead give permissions to the global groups you want to have access or give the global group deny permissions to the shares you don't want them to access or deny access this computer from the network user right for computers you don't want them to access shares on which can easily be managed via Group Policy. ... I have few shared folders on my w2k3 file server and most of them allow read access for the domain users group. ...
    (microsoft.public.windows.server.security)
  • Re: "Private Placement" considered Illegal Practice and Market Manipulation
    ... Unfortunately I'm a small foreign investor and english is ... ie. these are 4.4 million shares. ... this practice IMO looks much like a big fraud... ... Unregistered Sales of Equity Securities ...
    (misc.invest.stocks)
  • Re: "Private Placement" considered Illegal Practice and Market Manipulation
    ... Unfortunately I'm a small foreign investor and english is ... ie. these are 4.4 million shares. ... this practice IMO looks much like a big fraud... ... Unregistered Sales of Equity Securities ...
    (misc.invest.stocks)