For example, I have a group Department A. Among other users, I have a user named Boss. I want to create a file that can be changed only by Boss, and be readonly for the other users from that group.
I know that deny on the group level overrides allow on the user level so I can't do what I need just with share/ntfs permissions.
Here I see two solutions:
- Create a subgroup, for example, Department A without boss, deny that subgroup to write, and grant Department A permission to write. Will that work?
- Homer Simpson's approach. Set permissions individually for each user from a group.
Is there any elegant solution to this?
PS: OS is Windows 2003 Server