Home folder security permissions

[apprenticearb]

Hi All,

Hope this is the right Thread.

 

Need some advice with students being able to browse to other students home folders.

They can use programs from adobe suite to browse through the direct path of another user, and edit files and folders delete and create.

We have tried to work out how to prevent access through these programs but have come to a dead end.

User Home Folder permissions are as follows;

Allow domain\%username% - Full Control

Allow local\administrator - Full Control

Deny Domain\Staff - Special

Allow Domain\Staff - Modify

Allow Domain\Admins - Full Control

Any ideas to solve this would be appreciated?

 

Thanks.

Edited December 6, 2017 by apprenticearb

[Katy]

The first thing you need to do is ensure the NTFS permissions are set up correctly - there is no way students should be able to read or change other student's home directories. At a guess they have been set up with the default permissions being inherited from the root of the drive (giving the Users group access to everything).

[Steve21]

I'm guessing your permissions on the folder are setup wrongly if that's the case.

 

If the user doesn't have permissions to open the folders in the first place a program shouldn't allow them (as that just normally overcomes hidden ones)

 

What's a standard user folder have on permission wise?

 

Steve

[apprenticearb]

Allow domain\%username% - Full Control

Allow local\administrator - Full Control

Deny Domain\Staff - Special

Allow Domain\Staff - Modify

Allow Domain\Admins - Full Control

 

These are the permissions the students have in their own home folders.

I have attached a screen shot as well.

 

[RobD]

These are the permissions I've used in the past:

 

Share Permissions

 

Everyone – Change

Administrators – Full Control

 

NTFS Permissions

 

CREATOR OWNER (Subfolders and files only)

– Full control

Authenticated Users (This folder only)

– Traverse folder / execute files

– List folder / read data

– Read attributes

– Read extended attributes

– Create folders / append data

– Read permissions

SYSTEM (This folder, subfolders and files)

– Full control

Administrators (This folder, subfolders and files)

– Full control

 

To configure that users only can see the files and folders they have access rights to, enable Access Based Enumeration on the share.

 

I've used this tool to fix it:

NTFSFix

[Katy]

Allow domain\%username% - Full Control

Allow local\administrator - Full Control

Deny Domain\Staff - Special

Allow Domain\Staff - Modify

Allow Domain\Admins - Full Control

 

These are the permissions the students have in their own home folders.

I have attached a screen shot as well.

 

 

You need to remove the inherited permissions for the Users group (bottom of the screenshot), this is what is giving everyone access to everything

[clareq]

The bottom two permissions on your screenshot - are you allowing members of the local usergroup those rights? If so, check you haven't got any domain users in the local user group.

[Rob_D]

I thought deny permissions override allow ones. (or have I got this the wrong way around?) In which case, shouldn't those denys at the top stop access (for everyone???)?

[Steve21]

I thought deny permissions override allow ones. (or have I got this the wrong way around?) In which case, shouldn't those denys at the top stop access (for everyone???)?

 

Not when it's set on that folder only. If you have a subfolder e.g. 09test, and then Documents etc it wouldn't take that permissions, however the users one would as it's inherited

 

Steve

[apprenticearb]

The bottom two permissions on your screenshot - are you allowing members of the local usergroup those rights? If so, check you haven't got any domain users in the local user group.

Thanks Clareq,

That was the issue, that Local user by default is included in the group "Domain Users". That was causing the issues.

Don't know how or why it was setup like this.

Thanks for your help, this has been resolved.