Question about permissions on pupils home directories.

[Teth]

Just to add a little clarification to early posts about Pupil full control permission specifically assigned and Inherited Full control from ownership.

 

Full control from ownership will only happen if in some way the files and folders in question are inheritting the "CREATOR OWNER - FULL CONTROL" permission from somewhere. It is the windows default both server and Client to have this inherit from the Drive/Volume level of the file system. I set my "home" folder to not inherit permissions so that I can start fresh bellow it without this and restrict pupils so they don't have permissions to change attributes or permissions. We had a spate of pupils setting hidden on they're own files and claiming "the computer lost my work".

 

As a general rule now I tend to remove inherited permissions from any folder that will get shared on the network and start fresh for my own sanity if nothing else.

 

I'm really intrested in the quota management in R2. I'll need to impliment a new storage server for home space soon as we're adding a number of machines to the network and I'll get to use R2 on that.

[ianniow]

 

Given what I was saying, that sounds very odd. What are the NTFS folder permissions and what are the permissions on the share that the users connect to?

 

EDIT: And just in case, what AD groups are your students in. Any chance they are accidentally domain admins?!?

 

Well I don't believe it :oops: :oops:

Students were a member of domain admins. Its a good job my students are not the same problem as main stream High school. Mind you I think I would have noticed before now.

AJ thanks for making me look at the obvious.

[ajbritton]

Full control from ownership will only happen if in some way the files and folders in question are inheritting the "CREATOR OWNER - FULL CONTROL" permission from somewhere.

 

Sorry, but this is NOT true. When a user creates a file, they are the owner of it and regardless of the permissions that the file may inherit, the file owner has the permission to change the permissions.

 

It does appear to be possible to prevent this by limiting the overall permission via the share (ie using Change instead of Full Control), but IIRC, Windows will not let you redirect My Documents to a folder that you do not have Full Control over.