Help removing users permission from file.

Server 2012.  I have a file that when I look at the permissions on the security tab I see several groups with various permissions, there is also one user with Full Control.  When I try to delete that user I get a message stating the permissions are inherited so it can't be deleted.  I then checked the security tab on the folder where the file is located.  The user in question is not listed at all on the folders security tab so I'm  not sure how it is inherited.  Where are the "inherited" permissions for the user coming from?

I trying to remove User "Debra"

I get the feeling I am looking over something obvious, but I don't see it.

I have attached screenshots to help.
Screenshot of Permissions on file.Screenshot of Permissions on folder.
JeffMCCAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

zalazarCommented:
This could be caused by CREATOR OWNER.
Can you check the owner of file "PDF Passwords.xls" ?
You can try to resolve it by removing inheritance on file "PDF Passwords.xls".
Then remove user "Debra" and set inheritance back on.
Seth SimmonsSr. Systems AdministratorCommented:
it's inherited from the FS folder; she must have full control there
Scott CSenior EngineerCommented:
Try going to the "Advanced" button on the "Security" tab.

Then click on "Change Permissions" on the "Permissions" tab.

Uncheck "Include inheritable permissions from this object's parent".  Click on the "Add" button.

Ok your way out and then see if you can remove the user in question.
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

JeffMCCAuthor Commented:
@Seth, no permission on FS
@zalazar & ScottCha, yes that works, but generates another question.

I removed inheritance, deleted the user, turn back on inheritance.  Had another user (Leslie) open and save the file, then checked the permissions, she had full control of the file.  I then had the original user (Debra) open and save the file.  Now Leslie is gone from the permissions and Debra is back on with full control.  Both users are in the group Librarians and Normal Users  groups, but none of the other groups.  Librarians have write permission.  I removed Debra from the Librarians group and had her log out and back in.  She still have full control of the file.

Is it normal for the system to be setting and removing these permission as a file gets used?  Shouldn't Debra have lost access once removed from the group?

Thanks
Richard DanekeTrainerCommented:
As your testing validates, when you are the author of the file and you save it in a folder where you have write permissions--you also have full control of the file - but not full control of the folder.
zalazarCommented:
It's due to the "CREATOR OWNER" in combination with "Users Special"
From the screenshot I can see that on the directory there is also "Users  Special" defined which probably gives "Create files / write data, Create folders / append data".
In combination with CREATOR OWNER it gives permissions to write files and create folders.
This gives any user with read permissions on the directory the possiblity to create files and folders.
On every file or folder created by the user the user gets full control.

I checked it myself and it seems that to remove access for the user on the file you first have to set the owner of the file to e.g. Administrators.
After that first close the security windows and get the properties again.
Then remove inheritance.
It's actually better to choose remove so all permissions are removed, then just select the inhertance button again.
If you choose add and then check the inheritance button, inherited security and non inherited security will be there.

You probably have to consider to remove the CREATOR OWNER and special permissions for Users as it can otherwise happen again.

To resolve the problem for all files it might even be necessary to reset the owner on all files via "Replace owner on subcontainers and objects".
And to reset the security from the lowest directory level where security has been set explicitly via "Replace all child object permission entries with inheritable permission entries from this object".
All security from that directory and below will then be the same.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.