1

For example, I have a group Department A. Among other users, I have a user named Boss. I want to create a file that can be changed only by Boss, and be readonly for the other users from that group.

I know that deny on the group level overrides allow on the user level so I can't do what I need just with share/ntfs permissions.

Here I see two solutions:

  1. Create a subgroup, for example, Department A without boss, deny that subgroup to write, and grant Department A permission to write. Will that work?
  2. Homer Simpson's approach. Set permissions individually for each user from a group.

Is there any elegant solution to this?

PS: OS is Windows 2003 Server

1
  • You should specify your OS to make the question clearer.
    – davidgo
    Mar 12, 2013 at 6:44

1 Answer 1

6

Don't use deny. Instead:

  • Allow read for group "Department A"
  • Allow read+write for user "Boss"
1
  • Thanks, that works. Meanwhile I did the Homer's way with powershell scripting by iterating through all users in "Department A" %)
    – Kzhi
    Mar 12, 2013 at 11:35

You must log in to answer this question.