Solved

NTFS.  allow domain users view only.  allow group1 create new, not modify.

Posted on 2011-03-22
9
585 Views
Last Modified: 2012-05-11
Typically if i want someone to be able to create but not delete files they did not create, i just add creator/owner.  however i need all domain users to view this folder but have no ability to add files or folders.  
I need a second group to NOT be able to modify non-owned files, yet create new files and folders.  I will also remove delete and delete sub from this second group as they should not delete files.  I expect creator owner will override this for files they own, but I can deal with that risk.

the 3rd group will have modify.

how do i do this?
0
Comment
Question by:Eric
  • 5
  • 4
9 Comments
 
LVL 11

Accepted Solution

by:
TheGorby earned 500 total points
Comment Utility
First of all, remove any entries for 'Everyone' and 'Authenticated Users' on this folder. Then setup the following permissions at the folder level:

1. i need all domain users to view this folder but have no ability to add files or folders

-Domain Users group; check the Allow box for 'Read & Execute', 'List Folder Contents', and 'Read'.

2. I need a second group to NOT be able to modify non-owned files, yet create new files and folders.  I will also remove delete and delete sub from this second group as they should not delete files.

-Group#2; check the Allow box for 'Write'. (If they should not be able to delete even their own files, then in the special permissions for Group#2 check the Deny box for 'Delete' and 'Delete Subfolders & Files')
-CREATOR_OWNER; check the allow box for 'Full Control'

3. the 3rd group will have modify

-Group#3; check the Allow box for 'Modify'.
0
 
LVL 11

Author Comment

by:Eric
Comment Utility
hmm. I tried this.  end users told me he could still craete new folders as a "domain user"
mayhbe i need to create some test accounts and test myself. maybe im getting bad info back.

I thought maybe creator/owner made it so anyone including domain users could create files.  
But if yoru right, they need "write" to get that far.  

which is what i thought initially.
0
 
LVL 11

Expert Comment

by:TheGorby
Comment Utility
You're right he shouldn't be able to create folders or files. Assuming the info isn't bad, I would check to make sure there are no users/groups on the folder's ACL besides the 4 I mentioned before and any administrative users/groups. Also make sure the ACL on the parent folder is being propagated down to all subfolders and files.
0
 
LVL 11

Author Comment

by:Eric
Comment Utility
setting delete to deny does not allow them to create folders. when you say new folder, and type a name, it fails saying it can not rename it. I guess it creates it as "new folder" instantly.
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 11

Expert Comment

by:TheGorby
Comment Utility
Weird, you're right it's the same way on my system. In addition to instantly creating the folder as 'New Folder', when you rename a folder Windows must delete the original and create a new one, I don't know why else it wouldn't work...

Unfortunately I don't have a workaround for that other than individually denying 'Modify' rights to all files and folders that they should be able to modify.
0
 
LVL 11

Expert Comment

by:TheGorby
Comment Utility
*that they shouldn't be able to modify*
0
 
LVL 11

Author Comment

by:Eric
Comment Utility
yea.  maybe using a command line to create to folder or soemthing. ITs not that important.  If they created it, ill just let them have there way with it.
at least they cant delete others files.  and domain users cant create anything which was the main goal.

i created 2 test user and it worked perfectly.  No idea what that other user was doing. guess i should have confirmed they logged off and on.

Thanks
0
 
LVL 11

Expert Comment

by:TheGorby
Comment Utility
Even the Effective Permissions say creating a folder should be possible... I wonder if we've just found a Microsoft bug?
ss1.bmp
0
 
LVL 11

Author Comment

by:Eric
Comment Utility
i confirmed.
if that user opens a command line and types
mkdir test4 it will create a folder named test4
the gui method must create, and use some delete command to rename.  so effective permissions are technically correct.
0

Featured Post

Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

Join & Write a Comment

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Nothing in an HTTP request can be trusted, including HTTP headers and form data.  A form token is a tool that can be used to guard against request forgeries (CSRF).  This article shows an improved approach to form tokens, making it more difficult to…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now