Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What permissions does a user require to copy folders and the folders permissions from one mapped drive to another using explorer?

Our office has a large NAS with a number of shares. These shares are mapped to a specific drive letter for the users.

On one drive (X:) we have a folder that contains a large number of subfolders and specific security is assigned to the various subfolders. This is used as a template to create new folders on a different drive (L:). An administrative assistant will copy the template each time a new project needs to be created on the L: drive.

  • The template is copied using windows explorer (desktops are all winXP).
  • All the servers are running windows server, not sure of the versions but I think they are all 2008.
  • The user doing the copying has 'Full Control' permissions on all folders she is copying to (L:).
  • The user has 'Modify' permissions on the source template folder (X:).
  • The user account does not have any deny rights applied to it.

The user can copy the folders across. The permissions will not copy. The folders that are created on the L: drive will just inherit the parents permissions.

I'm not a sysadmin at the company so I can't provide many details on the SAN and server configurations.

Our IT group is telling us that the user doing the copying would require domain admin permissions on the entire SAN to make this possible. I'm not sure I agree as she currently can change the permissions on the folder by right-clicking and going through the properties for the folder.

We also tried using robocopy with /SEC and /COPYALL to copy the folders to the other drive but receive a permission denied error when it tries to copy the security.

share|improve this question
1  
The description's a little vague but here are my thoughts: does the user have any "deny" permissions somewhere? Deny overrules any allow permissions set. With inheritance, a deny somewhere can easily affect effective policies. Add in groups and nesting, tracking down effective permissions can get hairy. Technically, a SAN is a block storage device so I don't think it's possible to assign "domain admin" rights to a block storage device. There may be other "security" software (i.e. endpoint control, dlp) that may be blocking the file transfer action. this happens outside file system permissions –  bangdang May 9 '12 at 19:11
    
There are no deny rights for the user. We are in the process of adding security to this share, previously it was "everyone" with modify permissions. Also, the account can copy the folders. It's the permissions that won't copy. I've updated the question to include those. I don't think there are is any other security software in place. –  Bluesixty May 9 '12 at 22:57
    
Another approach to track down what, if permissions, are denying the copy is to setup auditing and looking at the logs client-side and server-side. –  bangdang May 10 '12 at 15:26
    
I'll suggest that to the server admins and see what they say. Thanks. –  Bluesixty May 10 '12 at 20:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.