Re: Rights and Effective Permissions in XP Pro

From: Danor (danor456L_at_passport.com.(donotspam))
Date: 10/31/04

  • Next message: George Mills: "Re: DCOM hell with SP2, Only way out seems to be system wide anonymous login" 
    Date: Sat, 30 Oct 2004 21:49:02 -0700

    Thank you Bruce, for the reply.
    I know that the "least powerful aspect of the Account is the strongest grip
    on the data that it will get". That is not an issue here. The account in
    question belongs ONLY to the Administrators group.

    So, the quandary persists...

    "Bruce Chambers" wrote:

    > Danor wrote:
    > > Im running XP Pro SP1. I have a number of volumes (NTFS) which I
    > > want
    > > to control permissions on and am very perplexed at why thie
    > > following
    > > is happenning.
    > > The volume root permissions are:
    > > (Allow) Administrator & Administrators are assigned Full Controll to
    > > This folder, subfolders and files;
    > > (Allow) CREATOR/OWNER is assigned Full Control to Subfolders and
    > > files
    > >
    > > Now, when I check the Effective Permissions within Windows Explorer
    > > (Rt-clk volume>Properties>Security tab>Advanced button)
    > > for Adminstrators, all is good (Full Control is displayed, e.g. all
    > > boxes are ticked).
    > > But when I then check a specific-named Account (who *is* an
    > > Administrator group member), NO Permissions are available (NOTHING
    > > is
    > > ticked).
    > > How can this be?
    > > As I understand NTFS permissions in XP Pro, Administrator(s) and
    > > Users/Power Users are mutually exclusive (you are one or the other,
    > > not both); I assert that the same is also true for Authenticated
    > > Users (this s/b because it is the Authenticated Users group and
    > > Guests who make up the User group in the first place).
    > >
    > > So how is it that an Administrative group member is denied
    > > permissions that Administrators have???
    > >
    > > --
    > > Patience is a virtue you exercise only when you need it...
    > > therefore,
    > > practice every chance you get... I've had a *lot* of practice!
    >
    >
    > If a user is a member of multilple groups, and thos groups have
    > differing levels of permissions, the most restrictive permissions are
    > those applied.
    >
    > --
    >
    > Bruce Chambers
    >
    > Help us help you:
    > http://dts-l.org/goodpost.htm
    > http://www.catb.org/~esr/faqs/smart-questions.html
    >
    > You can have peace. Or you can have freedom. Don't ever count on
    > having
    > both at once. - RAH
    >
    >
    >
    >

  • Next message: George Mills: "Re: DCOM hell with SP2, Only way out seems to be system wide anonymous login"