Re: Traverse Folder
From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 05/16/05
- Previous message: JDC: "Traverse Folder"
- In reply to: JDC: "Traverse Folder"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 16 May 2005 07:52:18 -0700
Traverse a folder does not mean List the content of the folder's
directory (as you have noticed). Hence, a user cannot "browse"
to the lower level folder starting at the top if they cannot list
the content of the upper levels - where "browse" means GUI
navigation with Explorer.
Bypass traverse checking only removes the need to have a
grant of traverse folder on all parent folders. When a user
with permissions at Level4 attempts a direct access to that
allowed folder this should be working with only the grant at
Level4. Try entering the full direct path in Explorer or by
using the cmd prompt to cd to that folder. The traverse grant
or check bypass comes into play because in order for the
system to even locate the lower level directory it needs to
use those of its parents, and it does do this in the context of
the executing account. Without either the Bypass traverse
right, or explicit grants of traverse this fails. Change the
permissions and try it again with full direct path in Explorer
or using the cmd prompt.
-- Roger Abell Microsoft MVP (Windows Security) MCSE (W2k3,W2k,Nt4) MCDBA "JDC" <JDC@discussions.microsoft.com> wrote in message news:AB907E86-1465-4A29-8585-C1A444995BDF@microsoft.com... > In the example (using Win2003 server, XP client): > C:\level1\level2\level3\level4 UserA has Full Control in C:\...\level4 but > no access above level4. All the verbage I've read states that traverse > folder will allow UserA to get to level4, "even if the user has no > permissions for the traveresed folders" but how? I've given UserA TF > permisions only on the upper folders, but access is denied. I've done all > the combinations of "Bypass Traverse Checking" to include removing the > "Everyone" group. The only way I can get UserA to level4 is to grant "List > Folder" to all the upper levels. How does this "Traverse Folder" thing work. > Thanks...
- Previous message: JDC: "Traverse Folder"
- In reply to: JDC: "Traverse Folder"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
