|
Posted by Roger Abell [MVP] on January 24, 2006, 8:07 pm
Please log in for more thread options The default were selected for "functionality", and notice that those are
only used on partitions where the OS is NOT installed which are assumed
to be data areas for user storage.
Also, notice that the Creator Owner grant in the default settings will
let the account that added some file/folder to delete it.
Do you have a more reasonable "best guess" as a one-size-fits-all set
of permissions that should be used upon defining a new non-boot
partition ?? Something had to be choosen, or else what, leave it
with no permissions and force all people to always have to set NTFS
permissions when a new partition is formatted ??
If a single storage area can be accessed over the network by means
of multiple network shares, then the one that is named/used in making
a connection is the one whose share level permissions will govern the
network accesses.
--
Roger
> Windows 2003 SP1 server here...
>
> I created a folder called "public" under the z:\ drive, shared it as
> "public", and verified that all users in my department had read-only
> permissions via a certain group. All seemed well until I saw legit data
> folders popping up in this shared folder that was allegedly read-only save
> for the admins. The user was able to create folders and files in the
> public share that was supposed to be read-only!!!
>
> Well...
>
> It seems to me that configuring a secondary volume, named as Drive Z:,
> brings liberal permissions to the root of the drive for the USERS group.
> Drilling down into the advanced security settings window shows 3 separate
> entries for the local-server\USERS group:
>
> --Read & Execute, This folder, subfolders and files
> --Create Folders/Append Data, This folder and subfolders
> --Create Files / Write Data, Subfolders only
>
> I looked at the other servers that we've built and all have the same
> all-too-liberal permission settings for the USERS group. It seems to me
> that USERS can do everything but delete files by default.
>
> Why is Microsoft allowing the USERS group such liberal permissions by
> default? It was a no-brainer to remove the EVERYONE group to tighten
> things up, but this issue seems to make things more difficult to lock-down
> security on file servers. Am I missing something???
>
>
> TIA,
> Mike
>
>
>
| 
XML Sitemap