Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For example, I have a group Department A. Among other users, I have a user named Boss. I want to create a file that can be changed only by Boss, and be readonly for the other users from that group.

I know that deny on the group level overrides allow on the user level so I can't do what I need just with share/ntfs permissions.

Here I see two solutions:

  1. Create a subgroup, for example, Department A without boss, deny that subgroup to write, and grant Department A permission to write. Will that work?
  2. Homer Simpson's approach. Set permissions individually for each user from a group.

Is there any elegant solution to this?

PS: OS is Windows 2003 Server

share|improve this question

migrated from Mar 12 '13 at 19:08

This question came from our site for computer enthusiasts and power users.

You should specify your OS to make the question clearer. – davidgo Mar 12 '13 at 6:44
up vote 6 down vote accepted

Don't use deny. Instead:

  • Allow read for group "Department A"
  • Allow read+write for user "Boss"
share|improve this answer
Thanks, that works. Meanwhile I did the Homer's way with powershell scripting by iterating through all users in "Department A" %) – Kzhi Mar 12 '13 at 11:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.