Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose User Bob is in Group A and Group B. Group A has write permission for Folder X but Group B has read only.

What should bob we able to do Folder X? What does windows do in this case? Is this purely a human only error?

We're currently experiencing problems on a domain we don't have control over. Users are not able to delete or modify any "older" files (perhaps before come change was made upstream). Any new files created are marked as "read only". When this checkbox is unchecked, it comes back.

Is there anything we can do on our end?

share|improve this question
up vote 0 down vote accepted

It sounds as though you have the share permission set to full control for everyone and creator owner permissions set on the NTFS volume, this will allow users to create files but only they can open and read them.

I suggest Give Group A read permission on the share, and group X change permission. On the file system at the of the shared folder, give group A read, Group X write permissions (if you want this group to have delete give the permission) I would suggest modify for this group. also remember to take all other permissions away leaving on the administrators with full control and your two groups (Remove inheritence), and push permisisosn down to sub folders.

Bob will have Write (or modify) access although he is in a read group also.

share|improve this answer

Most Windows permissions models are built around explicit "allow" Access Control Lists (ACLs) rather than "deny". NTFS (and other parts of Windows) supports setting Deny ACL's but they are not as commonly used.

The standard approach using "Allow" only permissions starts off with users having no rights at all. Then they are granted certain rights rather than being explicitly given "do or do not" states. So "Read only" is (usually) the absence the write permission. If you have two (or more) sets of permissions from two separate security principals (e.g. from your user account and a group membership or two separate groups) you are granted the result of all permissions from all principals so if any one of those has the "Write" permission then you get "Write" access even if one or more of the individual Security Principals only has "Read Only" access.

If Deny ACLS are used the same applies - if the user or any group is denied a specific right that overrides everything else.

In your case it's unlikely that Deny permissions are being used and Bob should be able to write to the folder. It may be a lot more complicated than that though.

On top of the explicit permissions on particular files\folders you have (optional) inheritance from lower levels so the effective permissions on a particular file or folder may depend on explicit permissions set at some level below (ie closer to the root) the particular object you are concerned with.

This is further complicated by the fact that Windows Shares have an entirely separate security model - shares can be set to Read only\Change or Full Control. If a share is set as Read Only then that will override file level permissions provided the user is connected using that share name. Having Change\Full Control rights does not override the underlying NTFS permissions however.

Finally there is also the standard file system "Read Only" flag. This isn't a permission as such but if it is set then nobody can change the file unless they reset the flag first.

share|improve this answer

When a folder is shared on a Windows server there are two sets of permissions to deal with: The Share permissions and the NTFS File permissions.

Make sure the group has the correct permissions on the Share tab as well as the Security tab.

Unchecking the read-only tickbox won't make any difference if the group only has read only Share permissions.

You need to give the group at least 'Change' permissions on the root of the 'Share'.

share|improve this answer
for what directories? The entire directory structure seems to have issues. – bobber205 Nov 5 '09 at 21:52

Two great articles about NTFS permissions can be found in part 1 and part 2.

Generally speaking permissions follow the 'most restrictive' rule. If a user is in two groups with conflicting permissions, then the most restrictive set take precedence. Your domain admin can also look at effective permissions for each user.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.