-3

We've tried editing permissions from an administrator account, but even users with all categories filed under "Deny" were able to edit their own security permissions. How do you fix this/Is there a better way to do this?

5
  • try another operating / filesystem..... :D Feb 27, 2012 at 16:12
  • Did you change the owner of the folder?
    – Safado
    Feb 27, 2012 at 16:15
  • Are you using XP professional or XP home? Feb 27, 2012 at 16:26
  • A possible alternative could be file level encryption.
    – squillman
    Feb 27, 2012 at 18:32
  • Can you explain why you think you need to do this? Feb 28, 2012 at 3:50

2 Answers 2

2

If they own the files/directory, I believe the user would have the ability to alter permissions. I think in NTFS you'd have to have ownership as the administrator, the user couldn't be an administrator or in an administrative group, and you'd have to deny access to all but that user specific privileges to the files and directories, denying the ability to change permissions.

This may lead to unintended behaviors down the road, though. Most systems aren't this restrictive and software can make assumptions about what users can and can't do, so don't be surprised if something acts a little strange with this configuration.

1
  • +1. The owner of a file/directory can always change the permissions. As well as changing ownership on the user profile directories, you'd also have to remove the "bypass traverse checking" user right (by default everyone has this right) which can definitely cause compatibility issues. Even software built into Windows expects to have the bypass traverse checking right. Feb 28, 2012 at 3:50
1

This needs to happen a level above the actual folder content. On the parent folder, REMOVE the special permissions Change Permissions and Write (Extended) Attributes for the user. Then, REMOVE these permissions from Creator/Owner as well (new files and folders will get these). If they were inherited, Deny them instead.

How much effort this is to do for arbitrary numbers of users really depends on how you have set up your security infrastructure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .