Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

For example, I have a group Department A. Among other users, I have a user named Boss. I want to create a file that can be changed only by Boss, and be readonly for the other users from that group.

I know that deny on the group level overrides allow on the user level so I can't do what I need just with share/ntfs permissions.

Here I see two solutions:

  1. Create a subgroup, for example, Department A without boss, deny that subgroup to write, and grant Department A permission to write. Will that work?
  2. Homer Simpson's approach. Set permissions individually for each user from a group.

Is there any elegant solution to this?

PS: OS is Windows 2003 Server

share|improve this question

migrated from Mar 12 '13 at 19:08

This question came from our site for computer enthusiasts and power users.

You should specify your OS to make the question clearer. –  davidgo Mar 12 '13 at 6:44

1 Answer 1

up vote 6 down vote accepted

Don't use deny. Instead:

  • Allow read for group "Department A"
  • Allow read+write for user "Boss"
share|improve this answer
Thanks, that works. Meanwhile I did the Homer's way with powershell scripting by iterating through all users in "Department A" %) –  Kzhi Mar 12 '13 at 11:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.