troubleshooting Question

Windows share and security permissions confusion?

Avatar of dylyluv
dylyluv asked on
NetworkingWindows Server 2003OS Security
2 Comments1 Solution1556 ViewsLast Modified:
Hi Experts,

As a caveat to the following, I'm more of a UNIX/Linux administrator, and somewhat new to Windows networking of folder and file share/security/access.

Here's my problem, which I'm hoping is a simple fix.

I have two computing lab workgroups on two separate subnets:

Workgroup A has 15 WinXP PCs on subnet 5.5.104.xxx. There's a generic, non-administrative-rights user account made for the students of this workgroup, called "student". Other than the admin login, this is the only username on Workgroup A.

Workgroup B has a few PCs and a non-domain Windows Server 2003 on subnet 5.5.234.xxx. There's one shared folder accessible (called "CLASS1") on the Win2003 machine that any Workgroup A PC can access using Map Network Drive. CLASS1 has two subfolders, called PRODUCTS and SOURCES. On the Win2003 box, other than the usual admin account, I have a researcher account (BILL) added as a non-admin user (though this user hasn't logged on to the Win2003 machine yet; I'm just using this for testing before I hand the account to him). I want to give BILL read-only access to everything under CLASS1, but read and write access only to the PRODUCTS subdirectory.

I don't want to make BILL a user on Workgroup A's machines, but instead just have him use the already-established "student" account, and just access the share by logging in to \\Win2003\CLASS1 on Workgroup B.

The BILL account is able to map the drive successfully from Workgroup A to CLASS1 share on the 2003 box on Workgroup B, but, as hard as I try and fine-tooth-comb through the folder properties Security permissions, I can only make PRODUCTS writable to BILL (or even the admin account) if I allow Full Control at the CLASS1 level, which then opens everything up, which is what I don't want. Even if I then go to the other subdirectories, and tweak them, the problem persists. In other words, it's either all or nothing, with nothing giving the error at a Workgroup A PC when trying to create a folder in PRODUCTS as BILL:

Unable to create Folder.
"Unable to create the folder 'New Folder'. Access is denied"

The above happens even if I map a drive as administrator to CLASS1 and try to create a directory (though, if I log on as administrator to the C$ default admin share name, I have full access everywhere, as expected, and can create a directory anywhere).

I even went into PRODUCTS and SOURCES individually, and removed the inheritable permissions from CLASS1 as the parent, making sure that BILL is listed in the Security tab with write permissions in PRODUCTS, and not in SOURCES. I even went to CLASS1's properties Advanced and made sure that as a parent, it couldn't propogate its permissions to the child directories. I carefully checked the Effective Permissions in Advanced as a sanity check of CLASS1 and the PRODUCTS and SOURCES subdirectories, and everything reports what I want to happen....but still, no luck!

I'd rather not give BILL ownership of any folder on the Win2003 box.

It doesn't appear to be a firewall issue, or blocking SMB traffic through any switches, and File and Print Sharing is turned on on all machines. Pinging one from the other works. I've also tried removing BILL from the Users group, and back again, with no luck. The fact that BILL can map the network drive and see contents tells me I'm close. Just not sure what I'm missing, here.

Any ideas would be appreciated, or any references to third-party software helpers that demystify Windows permissions.

Thanks!
Join the community to see this answer!
Join our exclusive community to see this answer & millions of others.
Unlock 1 Answer and 2 Comments.
Join the Community
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 2 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros