Re: I need a permission GURU!

From: Kent W. England [MVP] (kwe@mvps.org)
Date: 10/16/02 

From: "Kent W. England [MVP]" <kwe@mvps.org>
Date: Wed, 16 Oct 2002 13:36:40 -0700

Administrators and Users are two separate groups and "deny" to users
should not deny to administrators. However, it is possible that you have
some accounts with membership in both groups. In general it is better to
remove a permission than to deny access. Are you sure you can't just
remove a permission from users instead of using deny? 

--
Kent W. England, MS MVP for Windows XP
(Please respond only in the newsgroup)
nuckingfutsguy <nuckingfutsguy@hotmail.com> wrote:
> Ok, my question is:
> Are ALL users on the PC, (everyone that has some type of user acount
> created, including administrators and power users) considered part of
> the "users" group?
>
> I use two computers, one has XPHE and one XPPro. When I set deny
> permissions on a file or folder in either OS to lock out members of
> the "users" group, it also locks the administrator out and anyone in
> the administrator group.
>
> However, when I add the specific user account and set a deny
> permission on that one user, it works fine.
>
> Its as if all accounts fall under the "users" group. I have made sure
> that the accounts are only members of one group, either a user or
> administrator.
>
> Am I missing something simple here? Its my understanding that only
> users with limited accounts fall under the "users" group.

Relevant Pages

  • Re: I need a permission GURU!
    ... > accounts, and that group is the only group you've denied ... Then use the Deny ACE ... >>I have modified the members of the users group. ... >>> resource, so when an Administrator hits it, the access ...
    (microsoft.public.windowsxp.security_admin)
  • Re: I need a permission GURU!
    ... If the only members of the group are limited user ... Why not just create a new group, and stick the accounts ... Then use the Deny ACE ... >> resource, so when an Administrator hits it, the access ...
    (microsoft.public.windowsxp.security_admin)
  • I need a permission GURU!
    ... the Administrator and Power Users would fall ... Hence you're specifically putting a Deny ACE on the ... >on a file or folder in either OS to lock out members of ... >Its as if all accounts fall under the "users" group. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Setting user security in XP Pro
    ... > accounts and not the Admin account. ... If you set a Deny of Full Control for Administrators on ... be able to modify local policy. ... When you want to adjust the settings, remove the Deny, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Administrator Group Accounts
    ... >> I have several user accounts that are Members of the Administrators ... account that is generated during installation of XPpro had something ...
    (microsoft.public.windowsxp.basics)