Re: Deny specific user

The filesystem folder ? or one seen viewing active directory ?

An explicit deny overrules any grant, which is effective for the object
itself.
But such a deny is only potentially effective on any sibling dependent
content if the object is a container like a directory. Where the deny is
only inherited, any grant to the principal that is nearer the object than
the inheritance point of the deny will overrule the deny.

So, there is a simple (for filesystem at least) way to do what you are
after, if anything inheriting permissions from where you place the deny has
nothing but those inherited permissions (or only differences knowing made).

Roger

"zz12" <IDontLikeSpam@xxxxxxxxxxx> wrote in message
news:O75kcf6NIHA.2140@xxxxxxxxxxxxxxxxxxxxxxx
Hello. Is there a way to deny a specific domain user on folders and
subfolders on a w2k server active directory? Just wondering if it was
possible to leave the Everyone group access to a folder but somehow deny 1
specific user at the same time.

Thanks in advance.



.

Relevant Pages

  • Re: Corrupted object in AD?
    ... Deny everyone means deny everyone, ... you should reset the DACL to the default. ... SDE, Active Directory Core ... When I attempt to delete the object from ADSIEdit I get another ...
    (microsoft.public.windows.server.active_directory)
  • Re: Deny specific user
    ... of our server's 'c' drive this would basically deny access to this ... Further, even if everything on C: did inherit from the root, and so ... An explicit deny overrules any grant, which is effective for the object ... if anything inheriting permissions from where you place the deny ...
    (microsoft.public.win2000.security)
  • Re: how to restrict users to search in their own Organizational Unit
    ... To deny that right you must create a security group and deny read permission, then add the users to that security group. ... Active Directory, then he can see all users in Active Directory. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Permissions to see items in Mailbox?
    ... you can modify the active directory to remove the deny. ... > I have a problem with the rights of my exchange server. ... > the admin account, ...
    (microsoft.public.exchange.admin)
  • Re: do allowed perrmisions override denyed permissions?
    ... I thought deny access was more of a useful way to do things *TO* them! ... only grant permissions. ... | Explicit Grant ACEs for Object | ... to sort that out is with hierarchical precedence of the inheritance ...
    (microsoft.public.windows.server.security)