?
Solved

Permissions problems on Windows 2003 SBS server

Posted on 2007-07-24
21
Medium Priority
?
436 Views
Last Modified: 2008-02-01
Good Morning,
I already submitted this question and I guess it got lost in the ensuing E-Mail verification.  My question is regarding the permissions on folders and files on the Windows 2003 SBS server of which I have one only a few months old.  I recently updated it to service pack 2 for the server which I understand may have addressed some NTFS permissions issues.  Recently, within this past week, I am having difficulty with permissions set on the upper level of folders and files not propogating like it should down to nested folders and files within that chain.  Specifically i can reset the permissions on the uppder level folder and the nested folders and files will not show that permission and in fact will give us an "Access Denied" message for the individual folders and or files underneath.  This does not seem to occur with all folders and files under the top level folder,  it is an intermittent occurrence with only certian of the folders and or files within that folder chain.  And in fact when I try to reset the permissions at the upper level, the system kicks out certain folders and files claiming that there is insufficient disk space to accomplish the task.  This is not true as I have approximately 300 plus GB out of the original 400 GB left as free disk space.  If you have experienced anything related to this problem / issue, I would appreciate heraing about it.  Also if you have determinded a repair / fix for the issue or a related one either on your own or through microsoft, I would apreciate hearing about it.  Thank you in advance for your consideration and expertise in this matter.
0
Comment
Question by:greyp60
  • 9
  • 6
  • 4
  • +2
21 Comments
 
LVL 29

Accepted Solution

by:
Alan Huseyin Kayahan earned 2000 total points
ID: 19556769
         Hi greyp60
                 Did you check the "Replace permission entries on all child objects with entries shown here that apply to child object" box in Advanced security settings (click advanced in security window)
                 
Regards
0
 

Author Comment

by:greyp60
ID: 19556902
Yes,
Unfortunately Id have done that and it still seems to not want to take the entire reset.  It is only bombing out so to speak on certain files and folders with no apparent rhyme or reason.  And when it does you must go into those files/ folders individually and attempt a reset of the permissions.  This usually involves a resetting of the ownership for the file or folder first and possibly entering someone, maybe everyone as the access for the object.  Then when you set the inheritable and do apply it seems to pop back in all of the settings from above that it should have inherited in the first place.
0
 
LVL 8

Expert Comment

by:thenone
ID: 19557984
Have the administrator group take ownership and make sure that child propogates to all child folders.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:greyp60
ID: 19558046
I believe that we have already done that and yet it will not propagate to the lower levels.  I think that this may be a bug or whatever in the Windows 2003 SBS server security for folders and objects.  Because even when acomplished at a higher level folder, on these stubborn folders it does not propagate to the objects within that folder.  I must accomplish it manually file by file, etc.  I guess my question remains, is there a setting for rest of the folder security, etc.  I don't know!  Thanks!
0
 
LVL 8

Expert Comment

by:thenone
ID: 19558078
Who is the current owner of the sub folders and also who has permissions to the sub folders at leats admin should?
0
 

Author Comment

by:greyp60
ID: 19558377
That's the problem all of the subfolders do not have the "Administrator" attached as owner and those are the problem children.  But resetting at the upper level does not seem to propagate to those lower levels.  It is very strange and in working with both NT and Windows 2000 servers, I have never seen this problem.  It seems to be a "bug" or something in the propagation from the upper to the lower level of the folders and or included files.  Even with the inheritable permissions turned on.  In fact in the advanced window some user objects do not show as inheritable even with that turned on adn applied?
0
 
LVL 8

Expert Comment

by:thenone
ID: 19558454
if admin is not the owner and is not in the permisison it will not work. Admin will have to take ownership and then added to the security group. Did this just recently happen?
0
 

Author Comment

by:greyp60
ID: 19558602
Yes,
It occurred when I attempted to change the ownership of the master folder "Accounting" from everyone to a select group of individuals.  The funny things is that the folder was originally set-up with only these same individuals as the owners or thsoe with access rights plus the systems administrator.  I was working with Dell on another problem and they took over my system and made some permission changes.  when I wnet back to look just last week, everyone had access to this folder and it was no longer restricted to those few individuals.  And I had copied down the Windows 2003 SBS server, "service pack 2" and installed it.  I am wondering if there is a relationship there somewhere between the service pack update and my problems, etc?
0
 
LVL 8

Expert Comment

by:thenone
ID: 19558840
Service Pack shouldn't interfere with NTFS issues. What permisisons does accounting have now? and what does the sub folders have?
0
 

Author Comment

by:greyp60
ID: 19559044
The permisssions are for an everyone under the Master folder of Public.  But we were just looking at the files and it seems to have affected only the files created after our conversion wiht the new version of Office that we are running.  We are running Office 2007 on an XP platform for our workstations.  They are creating and saving them in Office 2007 as an old format file so that they can share them with others not running 2007.
0
 
LVL 8

Expert Comment

by:thenone
ID: 19559107
is this on a network drive server or are you talking about Exchange. Your last response threw me way off.
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 19559496
"I think that this may be a bug or whatever in the Windows 2003 SBS server security for folders and objects. "

It's definitely not a bug.

Your comment "set-up with only these same individuals as the owners" seems to indicate a misunderstanding of things.  Because in NTFS there can be only ONE owner.  So it does look as though you are referring to PUBLIC FOLDERS in Exchange and not Windows NTFS Folders.

Jeff
TechSoEasy
0
 
LVL 8

Expert Comment

by:thenone
ID: 19559673
Thanks Jeff I think your seeing what I am seeing.
0
 
LVL 2

Expert Comment

by:Will71
ID: 19561202
If this is Windows files/folders, and you are getting access denied, you need to go into the properties of the folders actually giving you problems and take ownership there, and then reset the permissions to enable inheritance. You're not going to be able to set it at the "master" folder and have it propagate down if the account you're using doesn't have permissions all the way "down the tree."  You'll have to manually touch each of the folders that have "Accounting" as owners and set it back to "Administrators" (the group, not the account).

If you're talking about Exchange, you need to do it in System Manager and NOT Outlook. You go into System Manager, drill down into Folders, right click on your "Master" folder and then go to all tasks->manage settings. From there you can either reset the permissions so that everything in the tree matches the permissions on "master," or you can otherwise modify permissions and push the changes down the tree using the wizard.
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 19561494
Will71,

That's just not true.  In NTFS, taking ownership is not reliant of whether or not inheritance is enabled.  If you set ownership of a directory and click the "Replace owner on subcontainers and objects" it will propagate down as long as the account you are logged in with has the authority to change ownership on those folders and files.  If you didn't have the authority, then "touching" them manually would have no different effect.

If you are logged in with an Adminstrative account and try to take ownership of an entire drive there will be bumps along the way on some System Folders and Files for which you will be prompted about whether or not you want to take ownership of those.  The answer should generally be NO... although it's never really a good idea to take ownership of an entire drive to begin with.

If this is Exchange we need more information before recommending anything.

But if it's not... then we need to look at what directories are being changed.  This is beause SBS automatically configures a \USERS share as well as user Quotas.

Jeff
TechSoEasy
0
 

Author Comment

by:greyp60
ID: 19564645
Hey all,

I just went into the "Public" folder which is the master upper level folder.  I go into the shares and set for everyone and administrators and apply.  Then I go into security tab and and administrators, everyone, creator owner, users, system are all set-up and have full control and I apply.  Then I go into advanced and all are there in the window.  The box for Allow inheritable permissions from the parent to propagate to this object is checked.  I checked the replace the permissions box and went to the ownership tab, clicked on the replace owner box and clicked on apply.  It starts rolling through the files in the first folder which is the "Accounting" folder where I seem to be having the most problems.  It then pauses at a folder within accounting and a file and says that access is denied and it relates to ownership and asks me to "continue" or "cancel".  I continue and it goes on and pauses again with the same message farther down in a diffferent sub folder and file, and dose this all the way through the "Accounting" folder.  It seems to be a problem related to ownership on certain files and or foldrs within this "Accounting" folder.  And if I drill down to those specific folders and do the same it will not show any ownership under advanced for that folder even though the " administrators" are listed under the ownership tab.  If I go through this process and set the administrators as owner for that folder everything seems to po into the advanced permissions box, but some of the file within the folder still have to be modified manually.  I have the settings to propagate this to the child objects underneath, but it doesn't seem to be getting through.  In examining some of these files late yesterday, they had been created after our conversion and copying over of our data with the new Office 2007.  They were created as older style files so that anyone in the office that did not have office 2007 could open them.  I hope that clarifies things a little.  Thanks!
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 19567514
Okay... so we know now that you are talking about NTFS folders.  

You must TAKE ownership before you can change the permissions.  So click on Advanced... but don't change anything on the Permissions tab yet. Click the Owner tab and that will probably say that the Current Owner is Administrators.  If not, change it to Administrators.

You must then check the box that says "Replace owner on subcontainers and objects" and click Apply to make it so.

You can then go back to the Permissions tab and change the permissions that you want to propagate down to all folders and they will do so without error.

Jeff
TechSoEasy
0
 

Author Comment

by:greyp60
ID: 19567912
Jeff and all,

I believe that I have gotten it corrected with Dell Silver Server support's assistance.  It was a conflict with the way my "Sharing" and "NTFS Permissions" were set-up on a folder per folder basis.  Thank you for all of your input and assistance and I am sure that I will be calling on you all again!
0
 

Author Comment

by:greyp60
ID: 19573654
Yes,

Thanks I have resolved the problem with changes in my sharing and NTFS permissions setups.  I was not in tune with the changes that Microsoft made to Windows 2003 server as far as the permissions settings go.  Thanks again.
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 19573699
Actually, as I now re-read your comment http:#19564645 --- I do see that you tried to change ownership.  

It is true that if you have a a sub-folder shared with different SHARE permissions than it's parent folder which also is shared, the ownership changes may not propagate correctly.

So the problem that you said Dell spotted and corrected makes total sense now.

Jeff
TechSoEasy
0
 

Author Comment

by:greyp60
ID: 19828274
Thanks and this did get resolved by resetting the permissions.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The articles for turning off the Client firewall policy on the internet are for SBS 2008 and don't really help for SBS 2011. They actually moved the Client firewall policy. In 2011, the client firewall policy has moved to the SBS computers conta…
A quick step-by-step overview of installing and configuring Carbonite Server Backup.
This Micro Tutorial will teach you how to add a cinematic look to any film or video out there. There are very few simple steps that you will follow to do so. This will be demonstrated using Adobe Premiere Pro CS6.
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question