Avatar of Intelli-Seeker
Intelli-Seeker
Flag for United States of America asked on

how do I prevent NTFS "change permissions" from being granted to the owner of files on Windows 2012 shared folder?

I'm trying to build a share where users can create and manage their own files, but not those belonging to others.  
Steps I've taken:
  1. I create the folder 'sharename', remove all inheritance
  2. add domain and local admins with "full Control" access.
  3. add "Creator/Owner" with all advanced permissions except "full Control", "Change permissions", and "Take ownership"
  4. add Authenticated Users with "Traverse folder/execute file", "List folder/read data", "Read attributes", "Create Files/write Data", and "Read permissions"
 
So here's the issue:  When USER_A creates a file on the share, their user ID becomes the owner of the file, and they should get all of the permissions granted to the owner as noted above, but what happens is that they get those, but in addition they also get the "change permissions" access.

Where does that "change permissions" access come from, and how can I prevent the user from getting it when they create a file?
* NTFS* permissionWindows Server 2012* Fileshares

Avatar of undefined
Last Comment
Robert Retzer

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
Robert Retzer

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Intelli-Seeker

ASKER
I guess I should have realized this.  Getting caught up in the weeds a bit.  Thanks!
Robert Retzer

It happens to all of us.... we often need another person who may see the problem from a different angle. We all often over look the obvious. Thanks for awarding the points...
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes