|
Posted by Roger Abell [MVP] on October 12, 2006, 7:40 am
Please log in for more thread options There are a few ways. One that seems most close to what you have is
parent (of QA) :
Domain Admins - Full
Authenticated Users - Read & Execute
parent\QA:
inherit from parent
Group A for read, execute
Group A special permission ( "delete subfolders and files" ACE)
parent\QA\Magic:
blocked inheritance
Domain Admins - Full
Authenticated Users - Read & Execute
Group A for read, execute
Group A special permission ( "delete subfolders and files" ACE)
However, for simplicity, I would make the parent\QA
have NTFS permissions settings identical to those shown
for parent\QA\Magic
Again, your intial issue was due to the fact that the grant
on parent\QA of
Group A special permission ( "Delete subfolders and files" ACE)
effectively states, "you can delete subfolder Magic and its content"
You could alternatively use
parent\QA\Magic:
inherit from parent
Group A special permission Deny ( "Delete" ACE - Applied to This folder
only)
I prefer to avoid use of Deny, even at cost of slightly more
complicated positive statement of permissions, ex. above.
However, in this case, where one only wants to protect one
folder from deletion, i.e. Magic, the main reason to avoid use
of Deny is not a consideration (i.e. the problems that result
when one depends on inherited Deny).
Roger
> Yes, do me a favor and tell me how you setup your share and security
> permissions exactly, I want to see if they are similar .
>
> Roger Abell [MVP] wrote:
>>> Roger I also tried what you said, I removed inherit permissions and did
>>> copy -
>>[quoted text clipped - 4 lines]
>>>
>>> Can you please try this and you will see that it does not work.
>>
>>Actually I have quite a bit set similarly that does work.
>>Perhaps your user is in some other group you are overlooking?
>>Also, I said quite more than just bolcking inheritance and saying
>>to copy. That just set the starting point for the mofications.
>>Did you do those ??
>>
>>>>> Ok so I'm still having problems
>>>>>
>>[quoted text clipped - 10 lines]
>>>>>>> http://www.winserverkb.com/Uwe/Forums.aspx/windows-server-security/20061
>>>>>>> 0/1
>
> --
> Message posted via http://www.winserverkb.com
>
| 
XML Sitemap