Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here is our setup. We have a domain and are running a windows 2008 file server. All of our macs are joined to the domain. When user A connects to the server and creates a new folder in his share, he becomes the owner and everyone on his team still inherits their original permissions for the files he creates. When user A leaves the company, the folder becomes owned by an invalid user since the AD account is disabled and no one, not even Administrator, has access to view the files in that folder. Of course, Administrator can go in and change the owner of the folder so everyone can see the files again but there must be some way to set up the permissions so that the administrators are always the owners.

share|improve this question

1 Answer 1

You are correct that the server admin can take ownership of the folder and reset permissions/inherit them again, etc.

What it sounds like is happening is you are setting your NTFS permissions as "Full Control" instead of "Modify" for your users. By giving them FULL CONTROL you allow them to take ownership of folders/files on the server shares when they create folders.

The better choice here is to setup DOMAIN ADMINS as FULL CONTROL on the NTFS shares/folders and then setup your local domain groups/users as having MODIFY access only. This will allow them to create folders, but won't allow them to take ownership or set security on folders/files.

share|improve this answer
    
As a test of this I had a user create a folder and put a file into in one of the department shares that he had access to. The group the user belonged to did not have "Full Permissions" to the share but the folder he created was still owned by him. Perhaps a valid workaround would be to create a script that scans shares for folder owners and replaces them with Administrator if it's not already set. –  StackShin Oct 2 '13 at 21:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.