Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

having permission issues for 2 users using active directory.

added 2 new users to ourdomain.controller/users folder.

The 2 users were auto. added to the Domain Users Group.

Went to the local G:/ drive on the AD machine. The Domain Users group is read only permission to the G:/ drive, exactly what I want.

Went into G:/rw and edited security/permissions. Removed inherited permissions and added the 2 new users and gave them read/write. Why can't the user write to this folder when the map G:/ ?? Access denied.

I even go to G:/rw, properties/security tab/advanced/effective permissions then select the 2 new users and the full control permission is checked.

Any help would be appreciated.

Thanks.

share|improve this question
    
are the share permissions correct? Or just read only? –  TheCleaner Jul 26 '13 at 17:28
    
i went to g:/rw properties/sharing/advanced/permissions and added the new users and gave full control –  dan Jul 26 '13 at 17:32

2 Answers 2

up vote 2 down vote accepted

You need to fix the share permissions.

Set your share permissions as follows:

DOMAIN ADMINS = Full Control

EVERYONE (or DOMAIN USERS) = Write/Modify

Then your NTFS permissions will still be in effect and lock down the root directory as you wanted.

It's pretty irrelevant to mess with share permissions at all. The above is how I set EVERY share and then just use the NTFS permissions to lock down the actual access.

share|improve this answer
    
properties/sharing indicates who can map, properties/security indicates who can read/write. Thanks for the help, this is exactly what I was looking for. –  dan Jul 29 '13 at 16:36

I suspect someone is going to come along and close this as a duplicate, as I'd be shocked if no one ever asked this before, but...

You need to assign both NTFS level permissions (what you're talking about) and share level permissions. It sounds like your users don't have write access on the share level.

If the other users do have write access, it's possible that they're a member of a Windows security group that these two aren't.

share|improve this answer
    
on the g:/ share level perms, I don't want the 2 new users to have write to root, just g:/rw. do I add the new users with write to root directory? –  dan Jul 26 '13 at 17:36
    
What TheCleaner said, basically. The share itself should be write/modify, the top level of G should not have any permissions beyond read, and then you can add the write privileges to the subdirectory. –  Katherine Villyard Jul 26 '13 at 17:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.