I have a network share that is several levels deep. For one particular folder, I would like to assign different rights than the default access that the shared folder is allowing. However this does not seem possible, as all of the child rights and inherited from the share rights. So if the share rights set the share to read-only can I not override the permissions in a child folder to allow write access?
1
-
What I did was set the share permissions to Read/Write and set the NTFS file system permissions to Read only. This seems to work. The users cannot modify files that they do not have sufficent rights to.– Aaron MJun 16, 2009 at 16:20
Add a comment
|
4 Answers
Most Microsoft people will tell you that you should set your permissions correctly at the NTFS level and then open up your shares unless you have some really good reason for doing the permissions at the share level. There is a lot of flexibility in NTFS permissioning that should let you do whatever it is you need to do and having the files RW at the file system level is a big security hole if one of your employees manages to log on locally somehow.
answered Jun 16, 2009 at 16:14
No you can't override share permissions.
Share permissions sit on top of the NTFS permissions. You need share and NTFS permission to do anything to a file that is accessed through said share. So it is quite permissible to give "Everyone" full RW access at the share level, and then control what they can actually do at the NTFS level. Which is what you will need to do in this case.
That is correct. Share permissions trump any file permissions. This is standard. Most files are RW for Everyone but then restricted at the share level. If the file permissions overrode the share, there would be no point in share permissions.
Your best option is to share the subfolder with it's own share and share permissions and allow users to access it that way.
answered Jun 16, 2009 at 16:03
As a best practice, the most efficient way to configure share permissions is with Authenticated Users having Full Control access. Then, the NTFS permissions should configure each group with the required permissions. This provides security for local and network access to the resource. It also provides protection of the resource for when it is backed up and when the resource name is changed or relocated.
To calculate the effective permissions for a user accessing a resource via a share compare the share permissions and the NTFS permissions for the user and use the most restrictive permission. There is no precendence per se except for restrictiveness. Share permissions are not applied if you do not access the file via the share.
If you are using server 2003 SP1 or higher you can alaso use access based enumeration to further secure the resources. See Windows Server 2003 Access-based Enumeration
