Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I add the user in the Global Security Group (IT Dept), and create a folder and add the IT Dept in security permission on it.

Under security tab of the folder, I want to remove the Machine\Users group (because this allows users to access the folder), but when I hit the remove button, a message "You cannot remove ....because this object is inheriting permission to its parent" pop up.

If I click on the 'ADVANCED' button, what should I need to check or uncheck to allow me to remove the Machine\Users group?

What is the right setup to do in making a folder accessible to a specific group only.

share|improve this question

You need to stop the newly created directory from inheriting NTFS permissions from its parent directory.

To do that, you should uncheck the Allow inheritable permissions from parent to propagate to this object checkbox. You will then be prompted whether to Copy the parent directory's permissions to your new directory, or to Remove all permissions. You can then remove the ACL entry referring to MACHINE\Users.

See MS KB313398 for more info.

share|improve this answer
undertand. but when i uncheck the 'Allow inheritable permissions from parent to propagate to this object' all user access (Administrators, CREATOR OWNER, SYSTEM) have been removed also.only the Global Security Group - IT Dept has remain. Do i continue to uncheck the 'allow inheriatable...' – ck1201 Apr 8 '13 at 6:55
When you uncheck, you could select Copy to keep the existing permissions, then just remove those you don't want to keep. It sounds like you selected to Remove when you unchecked. – ThatGraemeGuy Apr 8 '13 at 8:40
this is what i did: i select MACHINE\User then select ADVANCED, uncheck the 'allow inheritable...' choose COPY. and then I can now remove the MACHINE\USER.. but still, the Folder is accessible to All users even they are not belong to the Secutiry Group i assigned to the Folder. – ck1201 Apr 8 '13 at 8:50
Then the users must be members of some other group which does have permission. Can you put a screenshot in your question? – ThatGraemeGuy Apr 8 '13 at 9:05
yeah! you really offer a big help.. but when can i send you the screenshots? – ck1201 Apr 8 '13 at 9:11

Under the "Sharing" tab enable to share it and either leave the share name alone or change it to whatever. Under the permissions (Permission button?) remove everyone in there. Add the user, "Authenticated Users" and then click all of the check boxes except full control I believe it's Read and Write only.

On the "Security" tab uncheck the box to inherit from parent and click "COPY" when it asks. Then remove "Creator Owner" and click Apply/OK.

Try this. You must share the folder in order for it to be accessed. There are ways around that, but for this we'll keep it simple.

share|improve this answer
I follow your instruction, unfortunately, this not solve my problem. Is there any other way?. I think my security Group is not working properly, when I created a Sales Folder and add MIS_Group but i cheked the DENY permission for MIS, still, it can access the Sales Folder. – ck1201 Apr 10 '13 at 6:16
Take some screen captures of the permissions of the Sales folder and all of the tabs and post them here so I can see exactly how you have everything configured. – Travis Apr 19 '13 at 13:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.