effective permissions - confused...

[s1mon321]

Hi,

 

We have a share on one of our servers for which 'Everyone' has Full Control.

 

Staff are members of a security group which tightens up the security on that share and its folders.....or so you would think.

 

Regardless of the perms we give to this staff group they still end up with Full Control.

 

Even if I create a new folder, switch off inherited permissions, remove the staff security group........they still have Full Control.

 

I know its probably something easy but just can't get my head around it - please put me out of my misery....

 

Cheers

[bladedanny]

If 'Everyone' has full control this will be the case unless you use the deny permission on your staff group. Simply removing, say the modify permisison of staff wont work (AFAIK). Try removing the everyone group and see what happens.

 

Hope this helps.

 

Dan

[s1mon321]

Do you suggest using Deny? I can get it to work that way but assumed that the NTFS perms themselves being more restrictive would take control.

 

Do you think its something to do with the NTFS permissions at the Share Level? Therefore even if I remove the group from a folder members of that groups are still getting access?

[bladedanny]

No I don't use deny, mainly because deny is higher than allow. So if a member of staff is in two groups then the deny permission takes effect. If you know that staff members aren't in more than one group you could use deny. Even with inherited permissions you would still be able to see them on that folder, they would just be greyed out. I usually just take out the everyone group and just list which groups need access.

 

Hope this helps.

[s1mon321]

Looks like my predecessor had managed to include our main staff security group in another with 'Full Control' and therefore any changes made to perms at folder level were being overiden - hence effective permissions always being 'Full Control'.

 

Have now removed that and can control access with that staff group.

 

Thanks for your help as always!

 

Simon

[bladedanny]

Glad you got it sorted.