Folder Permissions

[WillShakespeare]

This is a strange one.

I was showing a domain user on our network how to set permissions on certain folders so that only he (Legal department) and whomever he choses can have access, and everyone else read only.

The problem is that although I have taken control of the folder with him listed as Owner, and given him FULL CONTROL of the folder and subfolders etc., when he accesses the security tab, everything is greyed out.

I have removed the inheritance checkbox and refreshed this to the sub-objects, but still whenever he accesses it from his computer, it is greyed out.

Does anyone know what's going on here?

Will

 

[Davetoo]

Did you give his user ID full control, or a group that he is a member of?

If a group, then he needs to logoff/logon in order for that change to take effect.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[WillShakespeare]

Definitely his user id. What I'm wondering, though, is maybe because the domain users group (which has read only access to the folder - i.e. NOT share) is limited, and he is part of domain users, then that could cause an issue...

But then System Admin is also domain users before Domain Admins, so our administrator account should suffer the same if that's the case, and it does not.

However, I do note that if I try to change permissions from my workstation, logged in as Domain Admins I also get greyed out permissions buttons, even on folders where Domain Admins is owner and had full access. But when I log onto the server directly, no problems.

Does this extra bit of info help?

Will

 

[TNGPicard]

Does he have full control permissions on the share (not the NTFS portion). He'll need that to change permissions.

 

[porkchopexpress]

I'll second TNGPicards suggestion change 'Share' permissions are required to change NTFS permissions remotely.

 

[TNGPicard]

Right or wrong, and we can get into a big philosophy debate on this I'm sure, I PERSONALLY give everyone full control, Change and read on all the shares and then control the rest of the access through NTFS permissions since I can do that real easily from my machine. The few machines which have really sensitive material I don't even let all users connect to -- I have them set in the local security policy to require certain group membership to access the machine from the network. If I have an explicit share that I really don't want people even being able to connect do I might throw a deny on a group but usually I count on NTFS. I don't give most users access at the NTFS level to modify permissions though but the few that do, can.

mark

 

[porkchopexpress]

It's worth noting that if a user has 'full' share permissions and and full NTFS permisions they can alter the permissions list to folders which can be a pain if you have users that fiddle. Giving them only 'change' permissions will prevent them from being able to alter permissions.

 

[WillShakespeare]

Good ideas guys, and it does make a bit of sense. I wasn't thinking of shares because I was working on a folder way down the list from the root share.

Unfortunately our network file system is a bit delicate at the moment so I wouldn't be able to test on live folders, but I'll create a test share and some root folders and see what I come up with.

I'll post back my findings.