Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

[Further Edit]: D'oh, I'm an idiot. I just realized I knew about this a long time ago (NTFS is the problem here) and then forgot it because I haven't had to deal with anything where it mattered for so long. So...nevermind, I guess. Anybody know of a good workaround in Server 2008?

[Edit]: Oops, should have said: This is on a Windows Server 2008 based domain. I'm guessing that if there's a fix / alternative approach I need to take, it's going to be something in Group Policy, but whatever works.

This may be something obvious that I've just never noticed before, but I have a series of folders laid out similar to 'Director' -> 'Managers' -> 'Normal Staff' -> 'Part Time Staff'. Each is shared, with descending permissions, so e.g. the department head has Full Control on the 'Director' folder, and the lowest level employees have Full Control on the 'PT Staff' folder and no permissions on the upper folders. Pretty simple layout that mirrors the actual hierarchy of the department, and in theory (but apparently not in practice) accommodates the rather hectic nature of the place.

The problem I'm seeing - and maybe this is intended behavior, but it doesn't seem like it should be - is that if, say, a manager decides that normal staff need access to 'FolderX' that is currently in the manager's directory and they move it to the 'Normal Staff' folder, 'SomeFolder' doesn't pick up permissions for normal staff, even though it is now a subfolder of 'Normal Staff', which normal staff have full control of. Normal staff can copy the entire directory, in which case they'll gain 'Full Control' on the copy, but they can't directly modify the original files, or delete 'FolderX', for example.

Is there something I'm missing that will make any folder moved to a folder 'X' immediately inherit the permissions of 'X', regardless of who originally created the folder or where it was moved from? Or is there some better way to do what I'm trying to do that I should have thought of and didn't?

share|improve this question

1 Answer 1

You're talking about this: http://serverfault.com/questions/31709/how-to-workaround-the-ntfs-move-copy-design-flaw

I've had arguments with MSFT employees on this one. The argument is that it is operating as-designed. My argument is that it's not operating as the feature is marketed.

My best experiences have come from setting permissions at the share level and not using permissions at lower directories in the share. (I also highly recommend not allowing users to change permissions themselves!) When files are moved between shares it is a "create / delete" instead of a move, so permission inheritance occurs.

share|improve this answer
    
Oi, yeah, didn't see your post until just now after submitting the [Further Edit]. Yeah, I was aware of that but it was pushed so far to the back of my brain I didn't think of it this morning. Should've had a coffee before posting I guess. Thanks anyways for the advice. –  oditogre Aug 4 '09 at 16:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.