Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A little intro: I'm not a server admin, but I do some tech support for a small software company whose product requires users to have full control permissions to a mapped drive on the server in order to share files required for multi-user use. I believe our software uses an Access database.

My question is, let's say you have three user groups, A, B, and C. In order for our software to function correctly, a user will need full control privileges (not just read/write) to the Z: drive. Let's say user group A and B has this full control to the Z: drive, but user group C does not have any privileges to Z:. If a user is a member of all three user groups, would there ever be a case where they didn't have full control to the Z: drive?

I believe I have seen this with one company, they were having issues with our software and we had them give all their user groups full control and the issues went away, but I'd like a little more information on how user groups and permissions are set up, and if this could be causing problems with our software. FWIW, I have no way to change what's programmed in our software, so suggesting it should work differently (which it probably should) is futile.

share|improve this question
I can guess, but you might just want to confirm which Operating system and version you're talking about. – EightBitTony May 23 '12 at 17:44
That is a good question, which I'm not actually sure. There would be enough differences between OSes that this would behave differently? – bccarlso May 23 '12 at 17:47
Well you don't even say Microsoft Windows anywhere (which I'm guessing it is), and I don't know enough about that OS to comment, but maybe there are differences between 2k, 2003, 2008 etc. that make it worth stating. If in doubt, providing too much info is better than too little. Also, again I don't know if it matters, but are these local groups, domain groups, etc. – EightBitTony May 23 '12 at 17:49
up vote 3 down vote accepted

In regards to Windows permissions there are two sets of permissions: NTFS permissions and Share permissions.

In regards to NTFS permissions: NTFS permissions are cumulative and use a least restrictive mechanism. A user who is a member of multiple groups will have the least restrictive permissions of the culmination of the NTFS permissions granted to each group.

In regards to Share permissions: When combined with NTFS permissions, the more restrictive permissions prevail. For example, if the user or group has NTFS Full Control permissions but the Share permissions are Everyone|Read then the effective permissions (the more restrictive permissions) for any user or group is Read. To determine the effective permissions for a user or group, determine the effective NTFS permissions then determine the effective Share permissions, then determine the more restrictive permissions of the "combined" NTFS and Share permissions and those are the effective permissions for the user or group. Most administrators choose to set the Share permissions to Everyone|Full Control and then "control" access via the NTFS permissions.

Deny permissions almost always take precedence over Allow permissions except in the case where an Explicit Allow over-rides an Inherited Deny. The precedence of NTFS permissions can be summarized like this:

Explicit Deny

Explicit Allow

Inherited Deny

Inherited Allow

share|improve this answer
This is greatly helpful for me to understand this better, I appreciate it! I will have to ask for some more information to try and figure this out. – bccarlso May 23 '12 at 18:23

I'm pretty sure you would not have an issue so long as none of the groups explicitly deny this permission... At least with a Windows Server.

share|improve this answer

Well, there are multiple layers of permissions involved here. I just assume it is Windows with NTFS, but the same should hold true for other OS/Filesystems which are CIFS/SMB compliant.

First, you have Share level permissions, and then you have FileSystem level permissions. Make sure that you grant access to the appropriate group on both levels.

If a user is a member of all three user groups, would there ever be a case where they didn't have full control to the Z: drive?

Yes, if you have an explicit deny in one group, or if your share/filesystem permissions do not match

share|improve this answer
So group C would have to have an explicit deny (which is different than just not having permissions to?) in order for a user who belonged to all three groups to be blocked from the Z: drive. Yeah, this is a Windows environment but I don't know much more then that. – bccarlso May 23 '12 at 18:11
Yes, a deny is different than not having permissions. A deny always takes precedence over everything else. So if you have a group with no permissions to a resource, a group with permissions to a resource, and a group with deny permissions to a resource, and you are a member of all three groups, then you would be denied permission to the resource – MichelZ May 23 '12 at 18:15
An Explicit Allow over-rides and inherited Deny. – joeqwerty May 25 '12 at 1:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.