Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Could someone explain this bizarre behaviour?

I manage a handful of servers connected to a much larger Active Directory network. All the Windows shares on our servers have a mixture of local account permissions and AD permissions.

In this particular case, something confusing has happened.

\\server\share\

Has permissions GROUP1:Read, Administrators... etc.

BUT:

\\server\share\FILE

Has permissions GROUP1:Read, USER1:All, etc.

Windows claims that USER1's permissions are inherited from the C: drive. Checking each folder downwards including the C: drive, the user's permissions do not exist in any folder.

I was able to reset the permissions by copying and pasting the file (it did not inherit USER1!) Strange.

Because USER1 had write access to this file, it caused some automation to fail. USER1 is part of GROUP1 and should only have read access.

Can anyone explain this strange behaviour, and how I might prevent it in the future?

share|improve this question

1 Answer 1

It's quite possible that the file was moved to that location from a different folder on the same volume. When you move a file from a different folder with different permissions to a folder in the same volume the original permissions are retained.

This article is a bit old, but the same rules still generally apply as well as workarounds on how to change this behavior.

share|improve this answer
    
Be also aware that, even if USER1's permissions are not explicitly stated anywhere on C:, they can also be granted through membership of USER1 in "Authenticated users", "Domain Users", "EveryOne", etc. This often leads to surprising effects that may not be immediately obvious at first glance. –  Tonny Aug 30 '13 at 14:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.