A permissions question

[sidewinder]

I was always under the impression that if say you have a file inside a folder on the network, that you want a whole group to read, and a few members of that group to write to, you assign the group read and execute on the folder (which propagates to the file inside) and then add the members you want to have write access to the ACL on the file itself.

 

So why doesnt this work? I've got a folder with about 6 different booking diaries in it. Only a few teachers are permitted to edit each one (and they are mostly different teachers for each) so I did the above, but I also have to add every single staff member that needs to edit *any* of the files to the permissions for the folder. I then have to go through every file and turn off propagation of permissions so that I can remove the ones that arn't allowed to access a specific file.

 

I must be missing something, there must be a better way? Is it because the most restrictive permisson always applies? But if it is, why does it work fine with their group only being able to read at folder level but their user account permissions take precedence then?

 

Sorry if Ive written this a bit confusingly lol

[elsiegee40]

It's probably easier to explain how I would do this than to try to sort out your explanation.

 

1. Create the holding folder. Remove inherited permissions. Give Read/execute to the Teachers security Group. Remove ALL unwanted permissions

 

2. For each Diary create a Security Group - make relevant teachers members of the correct security group

 

3. Give each diary security group Modify on the relevant diary.

 

Then a quick run around to make sure everything's fine. Hope this helps

[SYNACK]

Just a random idea, you are using security groups to assign these privileges rather than distribution groups as distribution groups don't pass out the access rights if they are specified.