Re: Accessing folders owned by another user?

"Al Dunbar" <AlanDrub@xxxxxxxxxxxxxxxxxxx> wrote in
news:OXiZbzGOIHA.4656@xxxxxxxxxxxxxxxxxxxx:

"Linn Kubler" <lkubler@xxxxxxxxxxxxxxxxxx> wrote in message
news:OZ8dRhDOIHA.4948@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

I have a user who was going into the security tap of folders in a
public folder and turning off the inherit from parent checkbox and
then selecting remove to block people from seeing her files.

Regardless of the actual NTFS ownership, they are not *her* files if
they are located where your standards say people are to store shared
files.

Kind of dumb since she could simply put the files in her home
folder,
but I digress.

To stop this I took away everyone's full control rights which I
assumed would work. It seems to have worked at some level, however,
I found today that she created a subfolder and did the same thing.
Looking into it now I see that everyone still has the rights to turn
off inheritance on objects they own.

I have three questions, is my observation correct, should a user
without full control of a folder they own be able to turn off
inheritance?

Ultimately, an owner can do whatever it wants. This is what you would
do as administrator to recover access to a folder that someone screwed
up by mistake: take ownership (you can because you are an
administrator), change permissions (because you are owner).

If so, is it possible to stop this and how?

Lastly, is there any way I can gain access to this folder without
having her password or changing the ownership of the directory? Is
it possible to give the administrator's account equivelent file
rights of a user or group? I don't want to tip her hand yet that I'm
on to her.

You are not "on to her", as her actions do not imply that she is
blocking access to some files to hide some illegal activity. Depending
on the published policies of your organization, your bypassing
security (!) to access a user's files without her knowledge could be
actionable without probably cause, so I would be careful if I were
you.

/Al

Thanks in advance,
Linn




There are also third-party utilities that allow you to "give" ownership
back to the user after you are done doing your thing (supposedly you
aren't supposed to be able to do this, but...)
.

Relevant Pages

  • RE: Show folder Inheritance via script
    ... I'm far from being an expert on folder security and inheritance. ... Determine if a trustee's permission on a folder are the same permission as ...
    (microsoft.public.scripting.vbscript)
  • Re: Inheriting a Form within the same project
    ... > related to my ignorance about namespaces and location of the source code ... > the new Inherted form and using the inheritance browser. ... > public Class formnew: TestApp.baseform ... > I tried and tried until I copied my project to the root folder of the ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: programmatically change permissions on folder in windows?
    ... as seen in the Adv / Edit drill-in, then the new ACE ... if inheritance is blocked at some ... > programmatically change permissions on folder in windows ... > Then folder> security> Advanced> Permissions> Replace permission entries ...
    (microsoft.public.win2000.security)
  • Re: Accessing folders owned by another user?
    ... I have a user who was going into the security tap of folders in a public ... folder and turning off the inherit from parent checkbox and then selecting ... To stop this I took away everyone's full control rights which I assumed ... I see that everyone still has the rights to turn off inheritance on ...
    (microsoft.public.windows.server.security)
  • SACL using WMI.
    ... I used WMI with ChangeSecurityPermissions and was able to add SACL to my ... I am still having problems with inheritance and setting ControlFlags on ... on the root folder (at least this is what my other script and SubInACL ...
    (microsoft.public.win2000.security)