Re: Share Folder
From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 03/29/05
- Next message: Roger Abell: "Re: Default Server Permission"
- Previous message: Edward Meyer: "Group Policy Errors 1030 and 1058"
- In reply to: mardskee: "Share Folder"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 29 Mar 2005 07:10:06 -0700
If an account is granted Full control to something, file or folder,
or if they create it so that they become the Owner of it, then that
account can manage the permissions of the file or folder.
I hope that gives you some hints. IOW the definitive way to
prevent this is to not grant more than change/modify and to not
allow "other" accounts to own the files/folders.
To allow accounts to create new objects but not give aways
ownership you must cook a homegrown solution, such as a
nightly script that hunts for items not owned by Administrators
and changes the owner of them.
To make sure that all permissions within an area are just so,
unaltered by owners of objects within the area, you can use
a File System definition in a GPO, or you can just check each
object that the solution you cook finds needing owner change
since if you do not grant more than change on the area then it
is only these objects that might need to have there permissions
reset.
-- Roger Abell Microsoft MVP (Windows Security) MCSE (W2k3,W2k,Nt4) MCDBA "mardskee" <amigo@elitemg.com> wrote in message news:OzZWkf%23MFHA.3336@TK2MSFTNGP09.phx.gbl... > I have a folder that I let all the users share in my office... a user > created a subfolder and removed everyone from the user rights... > > Does any one how can I still access this folder? How can I prevent some one > else from changing the security rights to a new folder? > >
- Next message: Roger Abell: "Re: Default Server Permission"
- Previous message: Edward Meyer: "Group Policy Errors 1030 and 1058"
- In reply to: mardskee: "Share Folder"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
