Non-tech staff setting share permissions

[ITWombat]

OK a little clarification, I talking about allowing non technical staff to set NTFS permissions on file and folders residing on network shares.

I know that only server administrators can set share permissions.

 

A teacher may want to customise permissions on a particular folder. In order to do this they have to remove inherited permssions. The problem with this is that they won't realise that they have to restore full permissions for administrators and system. This means that backups won't get done as the backup service account is likely to run as domain admin or local system. Ditto shadow copy and probably a lot of goodstuff in R2.

 

So the question is, is allowing users to set NTFS permissions just too risky?

[GrumbleDook]

Firstly ... I have to ask this ... WHY!?!?!

 

Secondly ... discourage them by telling them that it is an admin task that teachers are not meant to be doing anymore ...

 

Thirdly ... WHY!!!????!!!

 

Fourthly ... It is difficult and we can give you access to do it ... but be aware that these folders my not get backed up if you go around changing permissions ... if you get it wrong and someone deletes things then please do not come moaning to us ... no .. seriously ... we will not listen and will not care about the fact that the only copy of your dissertation (that was actually nicked from someone else anyway) has suddenly been edited and you name has been replaced all the way through with an amusing description of what you get up to at the weekends>

 

Fifthly ... Would you be interested in a web based course management system to do this for you? You would? Have a look at Moodle.org ...

 

Sixthly ... sit back and bask in the fact that you are once again the supreme being that has not only solved one problem but you have also helped the school by introducing a means of independant learning.

 

Seventh ... go and have a cuppa.

[ITWombat]

ROFLMAO

 

Great post as always Tony.

 

I would love to give a fuller reply but I've got to nip out for a bit.

[alan-d]

If they use office I'd suggest they use the file protection options available to them.

 

Otherwise - as per Tony's post

[ITWombat]

16 hours for a bit? Tha't a bad transfer rate even for dial-up.

 

Seriusly though...

 

@GrumbleDook

 

VLE would probably offer the granularity of control for shared resouces but loose other advantages of Windows 2003. I know know Moodle can do AD lookup for user authentication but WAMP looks like too much bother.

 

@Alan-D

There are two problems with that suggestion. 1> it only applies to Office files. What about PDFs? 2> Not very admin friendly: what happends if teacher forgets password. Doesn't prevent 'accidental' deletion.

[plexer]

Wombat: Why do you need to allow teachers to do this? why would a teacher need to customise file and folder permissions?

 

Ben

[ITWombat]

An alternative to the chain letter email for collaboration.

[sahmeepee]

I'd tell them you have a new system in place where you tell it in plain English exactly where the folder is and how you want it setting up, e.g.:

 

I want the o:\office\payroll folder setting up so that only Jenny in finance and SLT have access

 

The system works via emails to [email protected]

 

[plexer]

There's got to be a better solution to collaboration than that.

 

Ben

[meastaugh1]

There's got to be a better solution to collaboration than that.

 

Ben

 

Would WSS not suit?

[Irazmus]

How about a Wiki? It is after all what they were designed for and there are plenty to choose from:

http://www.wikimatrix.org/

[ITWombat]

I did think about Wikis but they have the same problem as V/MLEs unless you use Sharepoint Server/Services you loose a lot of the benefit of the Windows Server.

 

Wiki's are also more of free for all which might not be appropritae in a number of cases.

[Norphy]

Do you run Exchange? How about setting up a public folder?

[ITWombat]

Yeah that may hae t o be the long term compromise public folders for staff and V/MLEs for students.

 

Wasn't there something in the news about MS phasing out public folders in Exchange 12.

 

 

p.s. Interesting avatar Morphy. You're not Jeb of Jeb's Jobs fame?

[Norphy]

No, fraid not

 

I've been using that Worm avatar for forums pretty much since Worms 3D came out. I've always been a big fan of the Worms games. I think that was the desktop icon for the game

 

I think you're right about MS wanting to phase out Public Folders in Exchange. I think they are trying to push Sharepoint Portal Services for groupware and just have Exchange as an email server.

[GrumbleDook]

WSS is the answer to your needs. It will allow document storage in a relatively similar fashion to windows explorer.

 

If you want to have a look you can go to the sharepoint section of the M$ site (honestly can't be bother to search for the exact URL atm) you can set up a trial site to play with.

 

The collaboration works better with Sharepoint Portal where you can 'sign out' documents ...

 

HTH

[meastaugh1]

The collaboration works better with Sharepoint Portal where you can 'sign out' documents

 

Is there an improvement in check in/out in SPS over WSS? I thought functionality of that feature was the same. :?:

 

WSS vs SPS I believe the major benefits of SPS are My Site, Audiences, SSO and better navigation OOTB.

[GrumbleDook]

The collaboration works better with Sharepoint Portal where you can 'sign out' documents

 

Is there an improvement in check in/out in SPS over WSS? I thought functionality of that feature was the same. :?:

 

WSS vs SPS I believe the major benefits of SPS are My Site, Audiences, SSO and better navigation OOTB.

 

Isn't it the audiences bit linked to meeting spaces that is the big change in collaboration?

[MkII]

So does WSS work as well outside Office2003?

[meastaugh1]

So does WSS work as well outside Office2003?

Have a look at the Good, Better, Best document.

[MkII]

Great - thanks meastaugh1

 

I meant to ask as well about other apps - Acrobat was mentioned for example?

[meastaugh1]

Can't quite remember, but I think if you click the link to the PDF, I think it will either launch the PDF in IE, or in Acrobat Reader (probably depends whether you've set PDF in browser in the Reader).

 

If you're using an SQL server, as opposed to WMSDE, then you need to install the IFilter for PDFs, or any other file types you want to include in the full text searching.

[MkII]

Right - cheers! - suppose I could give the trial a spin

[eean]

The problem with this is that they won't realise that they have to restore full permissions for administrators and system.

 

Just a quick low-tech idea: You could make a batch file that uses the cacls command to add the administrator etc... to your folders. Schedule this to run before your backup task using the NT AUTHORITY\SYSTEM account.

[NetworkGeezer]

Nice idea but it needs to have a way of taking ownership first as you can't change ACLs otherwise.