Re: XP Pro file permissions

From: Wesley Vogel (123WVogel955_at_comcast.net)
Date: 03/18/04 

Date: Thu, 18 Mar 2004 00:36:59 GMT

Andrey;

Start | Help and Support | Type: groups overview | Click arrow |
Click: Groups overview
Also look at Related Topics
===============

Here are a few interesting links.

Understanding Local Users and Groups
http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/lsm_local_users.asp

Security, Users, and Groups Overview
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/spptsdk/html/tsovsecurityusersgroups.asp

File and Folder Permissions
http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prkc_fil_vtmz.asp

Over View of All Groups in Windows XP
http://www.kellys-korner-xp.com/xp_groups.htm

Introduction to User Accounts
http://windows.about.com/library/weekly/aa010325a.htm 

-- 
Hope this helps.  Let us know.
Wes
In news:105hhfvfm3rns90@news.supernews.com,
Andrey Tarasevich <andreytarasevich@hotmail.com>  hunted and pecked:
> Liam Falcon wrote:
>> Since the administrator account in question is also a member of the
>> Users group, the DENY ACL and any other ACLs will take place.  DENY
>> ACLs take precedence over Allow ACLs.  So, this administrator has
>> full control by the first ACL you created, but because of the DENY
>> ACL for write for group "Users" also applies to Administrator, that
>> account is denied writing.  Thing to remember?  DENY will overrule
>> an allow.  Use with caution.
>
> Yes, that's the conclusion I came to. But where can I see some kind of
> chart or diagram of whatever that shows, what users/user groups are
> implicitly included into what other user groups? For example this case
> demonstrates that all members of 'Administrators' group in XP are
> treated as members  of 'Users' group at the same time, even though on
> my machine the 'Administrator' account is not included into 'Users'
> group explicitly.
>
> This also brings the next question: how do I explicitly deny some
> inherited permission to 'Users' without denying it to 'Administrators'
> on some folder 'F'? The only way I see now is to stop inheriting
> permissions to folder 'F' and specify all permissions explicitly. Can
> it be done without breaking the inheritance?
>
>> Secondly, the Everyone group is called an implied group.  It does
>> not technically exist, but the system recognizes it as a collection
>> of any and all people.  With the creation of "Authenticated Users"
>> we now have a greater ability to give more open ACLs without giving
>> away access to unknown users.
>
> Thank you for your reply.
>
> --
> Best regards,
> Andrey Tarasevich

Relevant Pages

  • Re: Gpedit, I disable my own permission
    ... Log off and back in as an administrator. ... Go back to the same folder and remove the Deny ACE you had ... >> but I forgot to put the Gpedit, then I can enter on it again. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: HELP! Lost persmissions on a users folder
    ... the administrator ... should be able to access the folder unless you gave "deny" permissions to ... logon as an administrator and try to change permissions ...
    (microsoft.public.win2000.security)
  • File Folder Security
    ... You want to set Deny Read, Deny List Contents, etc. ... >even allow them to see that folder. ... if someone has either physical access ... >>your hard drive, or is an Administrator on the machine, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Denials effect all groups and users instead of the one their assigned to.
    ... You are not a member of Users group only if you have removed yourself from ... If you are still a member then setting deny on ... a folder will also effect you even if you are also in Administrator and ... >>- remove everyone from the folder permission ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Users denied access to my documents
    ... it should have the same acl as say, any profile root folder, ... domain users is the same as users on a windows client. ... There are a set of 3 acls which grant users access. ...
    (microsoft.public.windows.file_system)