File permissions

[Face-Man]

Hi,

I've just noticed that a few students have managed to reset the file permissions on their home drive to deny access for administrators to access them. Currently I've no idea how they are doing this (I thought right click was disabled in explorer) but is there a way to give them full control (so powerpoint can save) but not allow permisson changes ? Shoul I be looking at a gpo change (we have win 200 server at present) any ideas ? :?

[Mintsoft]

Hi,

I've just noticed that a few students have managed to reset the file permissions on their home drive to deny access for administrators to access them. Currently I've no idea how they are doing this (I thought right click was disabled in explorer) but is there a way to give them full control (so powerpoint can save) but not allow permisson changes ? Shoul I be looking at a gpo change (we have win 200 server at present) any ideas ? :?

have you given them ownership of them? We have it setup so that all documents are owned by Administrator, and only the administrators can Change Permissions etc

-Mint

[TechMonkey]

Can I ask what the Powerpoint saving with Full Control is? We have our users set to Read & Execute and everything below, but not Modify or Full Control. Not had any problems saving from anything.

Have you managed to gain control back of the folders?

[sahmeepee]

You can disable the security tab in a GPO. Like most GPO settings it's only taking away the interface rather than the right to change perms.

User config>Admin Templates>Windows Components>Windows Explorer>Remove security tab

They don't need full control on files to save by the way, they only need modify, but by default they'll have full control over files they make.

[Face-Man]

Hi
thanks for the ideas I'll give them a go. I've got control back by taking ownership of the root of their home share and then propogating child permissions. and will implement the GPO change and see how that goes.

As for powerpoint what we have found is that unless the user has full cotrol it saves 0k files it would appear powerpoint effectivley saves the file twice so if you just have write permsions it is no enough...

[ChrisH]

We apply modify permissions to the folders here. With regards to the administrator owning the folder and not the user... If your implementing quotas you may end up with innacurate totals depending on when you applied that setting.

[NetworkGeezer]

@TechMonkey

Does Read and Execute allow users to create subfolders?

[NetworkGeezer]

@FaceMan you should warn any students you catch removing administrator rights to their home folders that if they loose their work then you won't be able to get it back for them.

I didn't see what your reponse was to the backup software poll but these normally require a service account in builtin or domain admins group.

[Face-Man]

Can't find ..

User config>Admin Templates>Windows Components>Windows Explorer>Remove security tab

is it just avalible in 2003 we are still on server 2000 with XP clients

[ChrisH]

Try doing your GPO editing from an XP machine if you are doing it from the server.