not necessarily mean that I wear braces. It seems you do
(or at least you recommend to the OP that he does).
Post by Kerry BrownOne does not override the other. The most restrictive permissions take
precedence. In this case it's the read only on the share. It doesn't matter
what you set the the NTFS permissions to the share permissions only allow
reading. Vice versa if the share was set to full control and the NTFS
permissions were read you would get read only. It used to be that setting
the share to full control for everyone was the "best practice" and actually
the default setting. NTFS permissions were used to fine tune the
permissions. In today's security conscious world this is changing and many
people now recommend you use both sets of permissions to control security.
The important thing is to understand how they work in combination, be
consistent in how you apply them, and document everything so someone else
can figure why a certain user can't access a file when you're not available.
--
Kerry Brown
Microsoft MVP - Shell/User
http://www.vistahelp.ca
Post by Herb MartinIt does if you really care about your security, your business and
your resources, as opposed to the mild discomfort or embarrassment
that will ensue if your pants are droopy or even fall off.
And notice, it's actually a figure of speech to refer to someone who is
serious about getting things right as "a belt and suspenders man".
Also notice that "belt and suspenders" must be added, but we are
discussing built-in security and my GENERAL recommendation is
to NEVER give MORE privilege than necessary and never give
privileges to people (groups) who don't require that access.
People who are serious about security follow this as a general
Lock everything down; grant only the privileges required.
Post by Brains,Nonehhmm... What I do is to set the share to "authorized users", then use
the ntfs system for the rest...
j
Post by AllenMPegasus is correct here simple because SHARE permissions superceed NTFS file
permissions with the "least" permissive or as some say "most" restrictive.
If you start controlling access at the share level you'll find yourself
creating more groups and adding security more than you have to. What happens
if you share a top level folder with GroupA=READ and GroupB=Change then you
have sub folders where GroupA needs Modify access on one folder yet only
Read access on another? What are you going to do? GroupA can now only have
Read access within any folder or sub folder. you can't even create another
group and add those users to have Modify access because their in a Read only
Share group that will take precedent over any other group there in. industry
standards and best practices sine the old NT days have "always" been
Everyone-FULL at the share level and control folder security using NTFS.
Post by Herb MartinAt least with Pegasus I get the feeling he understands permissions.
I got that feeling he does also. It was you I was not quite sure understood.
But at least now you know...........
To restrict access the easiest, for NTFS, you can find the check box under public file properties, security tab, click advanced, click edit, and it should be there under the permissions tab. Then, (BEFORE you close the window, which would leave the folder inaccessible to everyone) open back up access to someone before you close out the window, by adding users and groups back in with whatever permissions are needed to get work done.
Note: this applies to NTFS permissions, not simple file sharing.
Post by KÃ¥reSI know this is an old thread, but Google and other search engines makes this a reference for ever, so an update;
If You as the Admin want to be in control of the access control in the directory tree, you should only grant Read and Modify at the Share to specific groups or Domain Users and Authenticated Users. You could additionally grant Administrators Full Control at the share.
The effect of this is that the ordinary users will not be able to change the access rights on files or folders below the share, regardless of having Full Control on them.
You must also remember that the owner of a file or directory may actually change the access rights, even if he/her doesn't have Full Control on the file/directory.
Therefor: Restrict access on the share.
This is also the recommended best practice from Microsoft for nearly the last 10 years.
Submitted via EggHeadCafe
Microsoft LINQ Query Samples For Beginners
http://www.eggheadcafe.com/training-topic-area/LINQ-Standard-Query-Operators/33/LINQ-Standard-Query-Operators.aspx