Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've a folder that I want a group of users can have read-only access, but only one of these users must have write permissions.

The problem is that seems that if that user pertains to the read-only group, it takes preference over the write permission gave to the specific user...

Is not possible to remove the user from the group... so... how I can make this work?

share|improve this question
Are you using groups to Deny access, or only to Allow access? – Kyle Smith Feb 23 '12 at 12:27
Look at the effective permissions for the user on the applicable folder. NTFS permissions are cumulative, so the least restictive permissions become the effective permissions. I suspect you've got something borked in the way that you've assigned permissions on this folder. – joeqwerty Feb 23 '12 at 12:55
That's too simplistic. As mentioned elsethread, explicit rules override implict or inherited rules, but explicit deny rules will always override explicit allow rules. – adaptr Feb 23 '12 at 14:13
Are you using Deny? If you are, you really shouldn't be. – MDMarra Feb 23 '12 at 14:43
up vote 4 down vote accepted

In NTFS permissions, Deny attributes overrule unset or Allow permissions. If the read-only group has write set to deny, no amount of allow rules from any other group membership will work.

There is an exception to this:

  • Inherited Deny permissions do not prevent access to an object if the object has an explicit Allow permission entry. (Source: Technet)

Also, and this may or may not apply to your set up, Share permissions are also applied, and if a share's permissions aren't set to allow changes, the user still won't be able to write to the folder even with the correct NTFS permissions.

share|improve this answer
Not true. An explicit Allow will over-ride an inherited Deny. – joeqwerty Feb 23 '12 at 13:25
Although you are right, I still think that wibbly's point has some good advice. Perhaps it should be edited... – Dusan Bajic Feb 23 '12 at 13:42
@joeqwerty it is true in other situations. But we don't now if OP has set the deny explicitly or even if he has set any deny-settings. – Tom Feb 23 '12 at 14:17
I probably should add 'As a rule of thumb' to the beginning. Thanks Tom for editting :). – wibbly Feb 23 '12 at 14:29

When you have problem with a well-designed product/model then you should revise your work.

I remember old days of permission models debates and role-based permission is the best out of them after these many years.

Probably the user with write permission doesn't belong to this read-only group and role management should be revised.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.