2

A little intro: I'm not a server admin, but I do some tech support for a small software company whose product requires users to have full control permissions to a mapped drive on the server in order to share files required for multi-user use. I believe our software uses an Access database.

My question is, let's say you have three user groups, A, B, and C. In order for our software to function correctly, a user will need full control privileges (not just read/write) to the Z: drive. Let's say user group A and B has this full control to the Z: drive, but user group C does not have any privileges to Z:. If a user is a member of all three user groups, would there ever be a case where they didn't have full control to the Z: drive?

I believe I have seen this with one company, they were having issues with our software and we had them give all their user groups full control and the issues went away, but I'd like a little more information on how user groups and permissions are set up, and if this could be causing problems with our software. FWIW, I have no way to change what's programmed in our software, so suggesting it should work differently (which it probably should) is futile.

Improve this question
3
  • I can guess, but you might just want to confirm which Operating system and version you're talking about.
    – EightBitTony
    May 23, 2012 at 17:44
  • That is a good question, which I'm not actually sure. There would be enough differences between OSes that this would behave differently?
    – bccarlso
    May 23, 2012 at 17:47
  • Well you don't even say Microsoft Windows anywhere (which I'm guessing it is), and I don't know enough about that OS to comment, but maybe there are differences between 2k, 2003, 2008 etc. that make it worth stating. If in doubt, providing too much info is better than too little. Also, again I don't know if it matters, but are these local groups, domain groups, etc.
    – EightBitTony
    May 23, 2012 at 17:49

3 Answers 3

Reset to default
4

In regards to Windows permissions there are two sets of permissions: NTFS permissions and Share permissions.

In regards to NTFS permissions: NTFS permissions are cumulative and use a least restrictive mechanism. A user who is a member of multiple groups will have the least restrictive permissions of the culmination of the NTFS permissions granted to each group.

In regards to Share permissions: When combined with NTFS permissions, the more restrictive permissions prevail. For example, if the user or group has NTFS Full Control permissions but the Share permissions are Everyone|Read then the effective permissions (the more restrictive permissions) for any user or group is Read. To determine the effective permissions for a user or group, determine the effective NTFS permissions then determine the effective Share permissions, then determine the more restrictive permissions of the "combined" NTFS and Share permissions and those are the effective permissions for the user or group. Most administrators choose to set the Share permissions to Everyone|Full Control and then "control" access via the NTFS permissions.

Deny permissions almost always take precedence over Allow permissions except in the case where an Explicit Allow over-rides an Inherited Deny. The precedence of NTFS permissions can be summarized like this:

Explicit Deny

Explicit Allow

Inherited Deny

Inherited Allow

Improve this answer
1
  • This is greatly helpful for me to understand this better, I appreciate it! I will have to ask for some more information to try and figure this out.
    – bccarlso
    May 23, 2012 at 18:23
0

I'm pretty sure you would not have an issue so long as none of the groups explicitly deny this permission... At least with a Windows Server.

Improve this answer
0

Well, there are multiple layers of permissions involved here. I just assume it is Windows with NTFS, but the same should hold true for other OS/Filesystems which are CIFS/SMB compliant.

First, you have Share level permissions, and then you have FileSystem level permissions. Make sure that you grant access to the appropriate group on both levels.

If a user is a member of all three user groups, would there ever be a case where they didn't have full control to the Z: drive?

Yes, if you have an explicit deny in one group, or if your share/filesystem permissions do not match

Improve this answer
3
  • So group C would have to have an explicit deny (which is different than just not having permissions to?) in order for a user who belonged to all three groups to be blocked from the Z: drive. Yeah, this is a Windows environment but I don't know much more then that.
    – bccarlso
    May 23, 2012 at 18:11
  • Yes, a deny is different than not having permissions. A deny always takes precedence over everything else. So if you have a group with no permissions to a resource, a group with permissions to a resource, and a group with deny permissions to a resource, and you are a member of all three groups, then you would be denied permission to the resource
    – MichelZ
    May 23, 2012 at 18:15
  • An Explicit Allow over-rides and inherited Deny.
    – joeqwerty
    May 25, 2012 at 1:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .