Why is the FULL Control rights NOT inherited to the sub-sub-folder ?

Hi Experts,
This is a very starnge case.
We have a highly confidential "Finance" folder on a Win 2003 server AD Domain. This morning CFO complianed he cannot get in to its sub-subF folders. I checked and found the "Apply To" for those users with Full Control rights in the sub folder is somehow automatically changed to "This Folder Only". Here is more detailed to help you understand the scenario:

Advanced Security Setting for Finance folder on U drive:
Type   Name   Permisson   Inherited From    Apply To
Allow  Admin Full Control   <Not Inherited>  This folder, sub-folders and files
Allow  CFO    Full Control   <Not Inherited>  This folder, sub-folders and files
Allow  FA      Modify          <Not Inherited>  This folder, sub-folders and files

Advanced Security Setting for SubF: (a sub folder of Finance)
Type   Name   Permisson   Inherited From    Apply To
Allow  Admin Full Control   U:\Finance\        This folder only
Allow  CFO    Full Control   U:\Finance\        This folder only
Allow  FA      Modify          U:\Finance\        This folder, sub-folders and files

Advanced Security Setting for Sub-SubF: (a sub folder of SubF)
Type   Name   Permisson   Inherited From       Apply To
Allow  FA      Modify          U:\Finance\SubF   This folder, sub-folders and files

Notice the Apply To for Admin and CFO on the SubF folder has been somehow changed to "This Folder only". And that is why they cannot access Sub-SubF folder. When I clicked "Edit" trying to change the Apply Onto, found it is dimmed.
Question is, why did it happen? Why did it only happen to the users of Full Control?
If I change Admin and CFO to have "Modify" instead of "Full Control" on Finance folder, the Apply To on SubF folder will turn to "This folder, sub-folders and files" which is normal.
If I create a brand new folder under Finance, I can easily re-produce this issue again and again. But this issue doesn't occur on all other folder than this Finance folder.
I've been thinking if someone installed some other additional security method on this folder. What could that be? And how to fix this issue?
Can you shed some light?

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Is there a group policy to set the security on that folder?
Hi right click on the folder go to security and select advaced i tick the first option and select copy then ok
now it should not be greyed out any more.

have you thought about creating security groups with in AD and then just adding users in to these in stead of have to always change permissions for individual users with these groups you only need to edit members.
B HCommented:
"not inherited" can mean two things:
- the permissions were added at this exact folder, and will affect subfolders
- the folder itself was set to stop inheriting permissions, and is controlling all of them by itself

at one point, someone went to 'security' on the 'finance' folder, advanced, and unchecked the option for parent permissions to propegate down to it.  then they set their own permissions there, which naturally carry down to "SubF" in this case.

so, if you set permissions on u:\ (whatever that points to - the parent of "finance"), those permissions will NOT affect "finance" or any subfolder of it (SubF in this case)


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
B HCommented:
a little further:

if U:\ permissions have this:
joe - full
mary - full
jim - read only
domain users - list contents
jake - DENY (any deny)

then by default every folder under u:\ will also have those permissions.

you can go to u:\finance, security and add more if you want:
mary - full permissions

if you do that, then "mary" will show as "not inherited", and all the rest will say "inherited from [the next level up]


now lets change that a little:
u:\finance, security, advanced, uncheck propegation, copy what's already there
now - it has the same permissions, but nothing is inherited because it lives at that level now
it also lives at u:\  but they are separated and anything you do on either will not affect the other

CastlewoodAuthor Commented:
issue still there
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.