Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Win2003 server and sharing a folder from \\server\data as read-only. In the share is another folder (d100) that I wanted to give RW access to a certain user u001.

I can connect with u001 to \\server\data and go into folder d100. But I cannot change or delete any file in this folder (even not with connection as administrator).

The ACL seems fine: Admistartors full access, u001 full access on the d100 folder.

share|improve this question

3 Answers 3

up vote 1 down vote accepted

See Microsoft Technet article on share permissions for the low down.

The short story of it is that the most restrictive permission applies, whether you apply it via Share permissions or NTFS. So you have the option of setting Read/Write permission to the share or folder, then reduced permissions on a subfolder via NTFS. This means you should probably set the least restrictive permission on the share (Everyone get's Read/Write) then restrict further using NTFS.

See also Microsoft's Best Practice for Shared Folders.

share|improve this answer
    
Ok, I get this now. Thanks. –  PeterMmm Aug 20 '12 at 13:28

Can u001 make any changes to items in that share (even outside of the d100 folder)? If not then make sure u001 has at least change access at the share level. You can view / set this by editing the share properties in Computer Management or from the Sharing tab on the folder properties.

You'll have to have change access at the share level if you want anyone to be able to modify any contents, and then manage further granularity at the NTFS permission level.

share|improve this answer
    
Ok, that makes changes in d100 possible, but on the share level too. I don't want this. –  PeterMmm Aug 20 '12 at 12:45
    
@PeterMmm see my edit. –  squillman Aug 20 '12 at 12:48
    
Ok, but do you know a way to avoid write access to the share root ? Users will create (unintentionally) a lot of folders there. –  PeterMmm Aug 20 '12 at 12:58

See Microsoft Technet article on share permissions for the low down.

The short story of it is that the most restrictive permission applies, whether you apply it via Share permissions or NTFS. So you have the option of setting Read/Write permission to the share or folder, then reduced permissions on a subfolder via NTFS. This means you should probably set the least restrictive permission on the share (Everyone get's Read/Write) then restrict further using NTFS.

See also Microsoft's Best Practice for Shared Folders. Key things to note:

  • do not deny permissions to the Everyone group
  • do not change the default permission (Read) for the Everyone group
  • -
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.