Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We've tried editing permissions from an administrator account, but even users with all categories filed under "Deny" were able to edit their own security permissions. How do you fix this/Is there a better way to do this?

share|improve this question
try another operating / filesystem..... :D – The Shurrican Feb 27 '12 at 16:12
Did you change the owner of the folder? – Safado Feb 27 '12 at 16:15
Are you using XP professional or XP home? – PalmerBomber Feb 27 '12 at 16:26
A possible alternative could be file level encryption. – squillman Feb 27 '12 at 18:32
Can you explain why you think you need to do this? – Harry Johnston Feb 28 '12 at 3:50

If they own the files/directory, I believe the user would have the ability to alter permissions. I think in NTFS you'd have to have ownership as the administrator, the user couldn't be an administrator or in an administrative group, and you'd have to deny access to all but that user specific privileges to the files and directories, denying the ability to change permissions.

This may lead to unintended behaviors down the road, though. Most systems aren't this restrictive and software can make assumptions about what users can and can't do, so don't be surprised if something acts a little strange with this configuration.

share|improve this answer
+1. The owner of a file/directory can always change the permissions. As well as changing ownership on the user profile directories, you'd also have to remove the "bypass traverse checking" user right (by default everyone has this right) which can definitely cause compatibility issues. Even software built into Windows expects to have the bypass traverse checking right. – Harry Johnston Feb 28 '12 at 3:50

This needs to happen a level above the actual folder content. On the parent folder, REMOVE the special permissions Change Permissions and Write (Extended) Attributes for the user. Then, REMOVE these permissions from Creator/Owner as well (new files and folders will get these). If they were inherited, Deny them instead.

How much effort this is to do for arbitrary numbers of users really depends on how you have set up your security infrastructure.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.