Re: NTFS Permissions for public share

On the share grant only Change (that prevents them from using
the ability to change permissions since Change "caps" what they
can do via share access despite having higher capabilities)
Also, you might want to adjust the NTFS grant on E:\DATA\Public
Authenticated Users: Modify (This folder, subfolders, and files)
to being
Authenticated Users: List
Authenticated Users: Modify (Subfolders, and files)
since you do not want to allow them to delete E:\DATA\Public


"George Lane" <george.lane@xxxxxxxxxxxxxx> wrote in message
news:%23%239rClK6GHA.2364@xxxxxxxxxxxxxxxxxxxxxxx
We'd like to create a public shared drive on a Windows 2003 server, with
the
following properties:
All authenticated users can read, write, modify, rename, and delete any
files and folders in the directory, but not change permissions on files or
folders.

We've set up the drive as follows:
NTFS permissions on E:
Administrators: Full Control (This folder, subfolders, and files)
Everyone: Read & Execute (This folder only)
SYSTEM: Full Control (This folder, subfolders, and files)
Local Users: Read & Execute (This folder, subfolders, and files)

NTFS permissions on E:\DATA\Public
Administrators: Full Control (This folder, subfolders, and files)
Authenticated Users: Modify (This folder, subfolders, and files)

E:\DATA\Public is shared as PUBLIC$
Share permissions on PUBLIC$:
Everyone: allow Full Control, allow Change, allow Read

We've found that when users create files or folders in the directory they
are set as the owner,
and have the ability to modify permissions. Is this the expected
behavior,
given the settings above?
If so, how do we prevent users from modifying permissions on folders they
themselves create
(other than changing permissions at the share level)?


George Lane
Atlanta




.

Relevant Pages

  • Re: Default permissions for the "Default User" account folder
    ... > I gather that Windows uses the permissions from this ... > folder when adding new user accounts. ... > Full - Administrators - This folder, subfolders, and files ... and have created several templates ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Directory Permissions - What gives?
    ... OK I can agree with that and "I stand corrected" on the guest account. ... Authenticated Users groups. ... If you had the parent folder shared at Everyone=FULL or even better ... permissions from the parent folder and add Group B and have inheritance ...
    (microsoft.public.windows.server.general)
  • Re: Why do some folders/registry keys have 2 permissions instead of 1?
    ... > I'm trying to write a script that will compare permissions for a large ... But if you check the folder or registry key's ... > group/user when it only needed to save one ACE. ... > gives Full Control to myuser for subfolders and files, ...
    (microsoft.public.win2000.general)
  • Re: Why do some folders/registry keys have 2 permissions instead of 1?
    ... > I'm trying to write a script that will compare permissions for a large ... But if you check the folder or registry key's ... > group/user when it only needed to save one ACE. ... > gives Full Control to myuser for subfolders and files, ...
    (microsoft.public.win2000.registry)
  • Re: Why do some folders/registry keys have 2 permissions instead of 1?
    ... > I'm trying to write a script that will compare permissions for a large ... But if you check the folder or registry key's ... > group/user when it only needed to save one ACE. ... > gives Full Control to myuser for subfolders and files, ...
    (microsoft.public.win2000.security)