Announcement

Collapse
No announcement yet.

How to test file permissions

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • How to test file permissions

    I am having the following problem:
    I have a folder as a shared resource on a Windows 2003 server.
    On the resource, the permissions are set so that only domain admins can write and everyone can read.
    But on some subfolders I assigned total permissions for some users. The problem is that they still can't write to their folders.
    The permissions on those subfolders seem fine.
    Is there any tool or anything for checking what is stopping them to write on their folders? How can I further check their permissions, or where else should I point to?

  • #2
    Re: How to test file permissions

    They can't access the sub folders to write due to the Read Only attribute that you set further up the tree.

    Why do your users only have read on the folder??

    Is this set via the share permission??

    Generally as a rule of thumb i setup shares with Authenticated Users have full control then set the NTFS permissions on folders.

    Comment


    • #3
      Re: How to test file permissions

      Take a look at the effective permissions.

      Also, check out the share permissions and make sure the are assigned the Change permission.
      http://technet2.microsoft.com/Window....mspx?mfr=true

      EDIT - Sorry Wullie, don't know why I didn't see your post.
      Regards,
      Jeremy

      Network Consultant/Engineer
      Baltimore - Washington area and beyond
      www.gma-cpa.com

      Comment


      • #4
        Re: How to test file permissions

        Have you used the "Effective Permissions" tab which is right click the folder, select Sharing & Security, on the Security tab click Advanced, click the Effective Permissions tab? Using this tool you can check to see who is alowed to do what without having to login as that user. Very useful.

        I think you might have set the share permissions restrictively, wheras the permissions should be set on the various folders rather than the share. I suggest that you set the permissions for the share to allow Everyone to change and read, and then you set the security on the folders to reflect what you want to restrict. Do you need any help on the differences between "share permissions" and "security on folders"? I can explain more if you would like.

        Also don't forget also to remove inheritance, by unticking the "allow permissions fromthe parent to propagate..." box in the Advanced section of the security dialog box.

        Edit: We're all typing at the same time!
        Last edited by PaulH; 20th March 2007, 12:43.
        Best wishes,
        PaulH.
        MCP:Server 2003; MCITP:Server 2008; MCTS: SBS2008

        Comment


        • #5
          Re: How to test file permissions

          Originally posted by JeremyW View Post
          Take a look at the effective permissions.

          Also, check out the share permissions and make sure the are assigned the Change permission.
          http://technet2.microsoft.com/Window....mspx?mfr=true

          EDIT - Sorry Wullie, don't know why I didn't see your post.
          No probs m8.

          Yours probably explains what i said a bit better.

          I hated studying those damn share permissions.

          Comment


          • #6
            Re: How to test file permissions

            Originally posted by wullieb1 View Post
            They can't access the sub folders to write due to the Read Only attribute that you set further up the tree.

            Why do your users only have read on the folder??
            I work at a University, and this the server that has some PDFs and other files that teachers leave for the students.
            So far, the teachers left the files for us to put them where they belong.
            But I thought why not creating a user for each teacher, assign them permissions on their subject's folders and let them write on them?

            Originally posted by wullieb1 View Post
            Is this set via the share permission??
            The main folder is a shared resource with permissions so that only admins can write and everyone can read. I tried adding the permissions on both the shared resource and the folder, but had no success.

            Originally posted by wullieb1 View Post
            Generally as a rule of thumb i setup shares with Authenticated Users have full control then set the NTFS permissions on folders.
            What's the purpose of having the permissions in 2 places? (I mean the permissions on the shared resource and the folder permissions)

            Or may be I should ask... what's the right way to assign the permissions here? Where should they have total permissions and where not?

            Comment


            • #7
              Re: How to test file permissions

              Well leoh, you got three people saying the same thing.

              Originally posted by PaulH View Post
              Also don't forget also to remove inheritance, by unticking the "allow permissions fromthe parent to propagate..." box in the Advanced section of the security dialog box.
              Paul, permissions are cumulative. You can always add more permissions without having to uncheck Allow permissions from...etc box. You would only need to uncheck this if you're inheriting permissions you don't want to give on the file or folder.
              Regards,
              Jeremy

              Network Consultant/Engineer
              Baltimore - Washington area and beyond
              www.gma-cpa.com

              Comment


              • #8
                Re: How to test file permissions

                Originally posted by leoh View Post
                What's the purpose of having the permissions in 2 places? (I mean the permissions on the shared resource and the folder permissions)

                Or may be I should ask... what's the right way to assign the permissions here? Where should they have total permissions and where not?
                The share permission actually sets the permissions for the share, i.e. Who can actually access the share and who can't.

                NTFS permissions actually set who can actually access the folder/sub folders and files.

                I think you have alot of reading to do.

                This should help

                http://www.microsoft.com/technet/pro.../13w2kadc.mspx
                Last edited by wullieb1; 20th March 2007, 12:53. Reason: Added link

                Comment


                • #9
                  Re: How to test file permissions

                  Originally posted by JeremyW View Post
                  Well leoh, you got three people saying the same thing.


                  Paul, permissions are cumulative. You can always add more permissions without having to uncheck Allow permissions from...etc box. You would only need to uncheck this if you're inheriting permissions you don't want to give on the file or folder.
                  Yes, they are cumulative, so he may well need to uncheck the box for the topmost folder, probably, and not untick it for folders lower down if they are less restrictive.

                  I would also say to Leoh, that as a rule of thumb, you should just have one share at the top, give read and change to that, and then forget entirely about the share permissions. Focus all your thoughts on the NTFS permissions and concentrate on those.
                  Best wishes,
                  PaulH.
                  MCP:Server 2003; MCITP:Server 2008; MCTS: SBS2008

                  Comment


                  • #10
                    Re: How to test file permissions

                    Solved!
                    Thank you very much!

                    I assigned total permissions to the share, and then assigned NTFS permissions.

                    Comment


                    • #11
                      Re: How to test file permissions

                      Originally posted by leoh View Post
                      Solved!
                      Thank you very much!

                      I assigned total permissions to the share, and then assigned NTFS permissions.
                      Excellent.

                      It took me ages to finally figure out what it all meant when i was studying.

                      Comment

                      Working...
                      X