Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

NTFS.  allow domain users view only.  allow group1 create new, not modify.

Posted on 2011-03-22
9
Medium Priority
?
636 Views
Last Modified: 2012-05-11
Typically if i want someone to be able to create but not delete files they did not create, i just add creator/owner.  however i need all domain users to view this folder but have no ability to add files or folders.  
I need a second group to NOT be able to modify non-owned files, yet create new files and folders.  I will also remove delete and delete sub from this second group as they should not delete files.  I expect creator owner will override this for files they own, but I can deal with that risk.

the 3rd group will have modify.

how do i do this?
0
Comment
Question by:Eric
  • 5
  • 4
9 Comments
 
LVL 11

Accepted Solution

by:
TheGorby earned 2000 total points
ID: 35192089
First of all, remove any entries for 'Everyone' and 'Authenticated Users' on this folder. Then setup the following permissions at the folder level:

1. i need all domain users to view this folder but have no ability to add files or folders

-Domain Users group; check the Allow box for 'Read & Execute', 'List Folder Contents', and 'Read'.

2. I need a second group to NOT be able to modify non-owned files, yet create new files and folders.  I will also remove delete and delete sub from this second group as they should not delete files.

-Group#2; check the Allow box for 'Write'. (If they should not be able to delete even their own files, then in the special permissions for Group#2 check the Deny box for 'Delete' and 'Delete Subfolders & Files')
-CREATOR_OWNER; check the allow box for 'Full Control'

3. the 3rd group will have modify

-Group#3; check the Allow box for 'Modify'.
0
 
LVL 11

Author Comment

by:Eric
ID: 35192181
hmm. I tried this.  end users told me he could still craete new folders as a "domain user"
mayhbe i need to create some test accounts and test myself. maybe im getting bad info back.

I thought maybe creator/owner made it so anyone including domain users could create files.  
But if yoru right, they need "write" to get that far.  

which is what i thought initially.
0
 
LVL 11

Expert Comment

by:TheGorby
ID: 35192268
You're right he shouldn't be able to create folders or files. Assuming the info isn't bad, I would check to make sure there are no users/groups on the folder's ACL besides the 4 I mentioned before and any administrative users/groups. Also make sure the ACL on the parent folder is being propagated down to all subfolders and files.
0
Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

 
LVL 11

Author Comment

by:Eric
ID: 35193478
setting delete to deny does not allow them to create folders. when you say new folder, and type a name, it fails saying it can not rename it. I guess it creates it as "new folder" instantly.
0
 
LVL 11

Expert Comment

by:TheGorby
ID: 35193556
Weird, you're right it's the same way on my system. In addition to instantly creating the folder as 'New Folder', when you rename a folder Windows must delete the original and create a new one, I don't know why else it wouldn't work...

Unfortunately I don't have a workaround for that other than individually denying 'Modify' rights to all files and folders that they should be able to modify.
0
 
LVL 11

Expert Comment

by:TheGorby
ID: 35193561
*that they shouldn't be able to modify*
0
 
LVL 11

Author Comment

by:Eric
ID: 35193571
yea.  maybe using a command line to create to folder or soemthing. ITs not that important.  If they created it, ill just let them have there way with it.
at least they cant delete others files.  and domain users cant create anything which was the main goal.

i created 2 test user and it worked perfectly.  No idea what that other user was doing. guess i should have confirmed they logged off and on.

Thanks
0
 
LVL 11

Expert Comment

by:TheGorby
ID: 35193578
Even the Effective Permissions say creating a folder should be possible... I wonder if we've just found a Microsoft bug?
ss1.bmp
0
 
LVL 11

Author Comment

by:Eric
ID: 35193651
i confirmed.
if that user opens a command line and types
mkdir test4 it will create a folder named test4
the gui method must create, and use some delete command to rename.  so effective permissions are technically correct.
0

Featured Post

Put Machine Learning to Work--Protect Your Clients

Machine learning means Smarter Cybersecurity™ Solutions.
As technology continues to advance, managing and analyzing massive data sets just can’t be accomplished by humans alone. It requires huge amounts of memory and storage, as well as high-speed processing of the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

An overview of cyber security, cyber crime, and personal protection against hackers. Includes a brief summary of the Equifax breach and why everyone should be aware of it. Other subjects include: how cyber security has failed to advance with technol…
Securing your business data in current era should be your biggest priority. Numerous people are unaware of the fact that insiders commit more than 60 percent of security breaches. You need to figure out the underlying cause and invoke your potential…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question