In computing, permissions (often called "privileges," "access rights" or just "rights") are rules associated with objects on a computer or network. Permissions determine which objects can access which objects, and to what extent.

learn more… | top users | synonyms (2)

5
votes
3answers
2k views

Delegating account unlock rights in AD

I'm trying to delegate the rights to unlock user accounts in our Active Directory domain. This should be easy, and I've done it before... but every time the user tries to unlock an account (using the ...
5
votes
2answers
3k views

crontab listing or editing results in fopen: permission denied

Recently, a job configured to run from a user's crontab stopped executing. When attempting to list or edit the crontab for the user, the result is: user@host:~$ crontab -l crontabs/user/: fopen: ...
5
votes
2answers
3k views

Is it possible to list all permissions where I don't have access

I'm looking for a way to recursively go through my entire file share ( fairly large 3TB of files ) and list out all files/folders that I don't have access to. Due to a migration and some errors on ...
5
votes
2answers
5k views

Linux acls uses wrong gid for domain groups, but numerical gids ok

Please see edit below, as it turns out that the problem is with uid/gid to sid mapping and shows a workaround that will help understand the problem more quickly. We have a Ubuntu 11.04 server ...
5
votes
3answers
708 views

Delegate log off privilege?

Is it possible to delegate the right to log other users off? I'd like to give users the ability to log another user off of a computer, but I'm not willing to make everyone administrators to do so. We ...
5
votes
1answer
784 views

Windows domain share permissions basics

Consider following share rights: Security \\dev\profiles\ rw – Administrators Security \\dev\profiles\bambus02 inherited AND rw – bambus02 Sharing \\dev\profiles rw – Everyone as "bambus02", my ...
5
votes
5answers
15k views

Domain Admins group denied access to d: drive

I have a brand new Active Directory (CORP-AD) installation running on Windows 2008R2. I have a domain controller (PDC01) and a member server (ME01). The member server has a C: and a D: drive. Part ...
5
votes
1answer
8k views

Is there a way to set access to WMI using GroupPolicy?

From various documentation it appears that to change WMI access you need to use WMI to access the running service and modify specific parts of the tree. Its kind of annoying changing 150,000 hosts ...
5
votes
4answers
9k views

How to deny execute permissions on a share/folder in Windows?

I am archiving files into self-extracting .exe files. I want the user to have to copy the .exe to their machine in order to execute (extract) the files. So I want to deny only execute permission. They ...
5
votes
3answers
277 views

What is preventing me from piping from a '600' file into mail within launchd?

In OSX 10.6 I'm running logcheck.sh via. launchd using this plist <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www....
5
votes
10answers
12k views

IIS6: How to troubleshoot a 404 error in an ASP.NET application?

I have an ASP.NET application on a Windows Server 2003/IIS6 that refuses to run for some reason (it's the Xerox Centre, if that info helps). It has been working flawlessly before though on this server....
5
votes
1answer
643 views

What exactly is included in the Windows “Everything” security identifier (e.g. does it include computer accounts like DOMAIN\MACHINE$)?

This is a generalization of a question I initially had asked about computer accounts. I asked: When one sets Windows permissions for "Everyone", do these permissions apply to computer accounts (...
5
votes
2answers
9k views

windows server 2012 remote desktop - Send messages between standard users

Does anyone know the policy, or registry change, etc. for allowing messages (on the same server) between standard users... an elevated cmd prompt or task manager works of course... but need it to ...
5
votes
1answer
3k views

Why can't I copy .zip files from a server to a server in a different domain?

At work, we're using a Windows Server 2008 R2 VM as our build server. At the end of the build process for any of our projects, we copy the packaged deployment files to a folder on the server where ...
5
votes
2answers
806 views

What is the proper way to set up the Apache document root in terms of privileges?

I have just installed Ubuntu 9.10 server edition on my machine and I wish to run my own personal local server with other users in the same LAN. First, I was wondering what folder directory structure ...
5
votes
2answers
1k views

Delegate permissions to subfolder in TFS project

I need to give a TFS Project Group contributor privileges to a Source Control subdirectory in a TFS project. I can connect successfully as someone from this group but can't browse Source Control, ...
5
votes
1answer
734 views

Different ACLs on two OU's with same “protect object from deletion” setting

Background After I configured our Active Directory so that the ability to move computers was delegated to helpdesk staff, I started hearing reports that computers would get "stuck" in specific OU's. ...
5
votes
1answer
3k views

Users suddenly missing write permissions to the root drive c within an active directory domain

I'm managing an active directory single domain environment on some Windows Server 2008, Windows Server 2008 R2 and Windows Server 2012 machines. Since a few weeks I got a strange issue. Some users (...
5
votes
2answers
5k views

I can't run uwsgi as regular user

I want to run uwsgi server as www user, but if I write: uwsgi --socket $SOCKET --chmod-socket 666 --pidfile $PIDFILE --daemonize $LOGFILE --chdir $CHDIR --pp $PYTHONPATH --module main --post-...
5
votes
1answer
6k views

Granting service control manager access permission to user outside of administrator group

I have a user outside of administrator group. How can I grant service control manager access permission for that (specific) user? It's like SC_MANAGER_ALL_ACCESS from the following link: http://...
5
votes
1answer
2k views

Share Point ACL on OSX Lion Server - Posix group always takes over ACLs

Trying to configure a share point on a Lion Server machine. The directory is created by the local server admin (serveradmin) and has rwxr-x--- given to it. The serveradmin user belongs to the local ...
5
votes
2answers
601 views

Changing windows permission non recursively

I have a Windows Storage Server 2008 machine acting as our company file server. I need to give someone access to same folder and files in our Marketing folder (which contains easily 100,000+ files). ...
5
votes
2answers
274 views

Upgraded users to Win7. Now getting “path not found” when saving files or opening attachments

We have a Server 2008 AD environment with about 5k users. We just rolled out Windows 7 SP1 (were XP) with great success. However, about once a day we get a few calls that a user opens a file from ...
5
votes
1answer
355 views

Ports below 1024

DISCLAIMER: I know how to run daemons that either listen on ports <1024 by using privbind or some iptables REDIRECT. Or more generally spoken, how to make daemons available on priviliged ports that ...
5
votes
2answers
6k views

How to add a privilege to an account in Windows?

Given: A VM running Windows 2008 I am logged on there using my domain account (SHUNRANET\markk) I have added the "Create global objects" privilege to my domain account: The VM is restarted (I know ...
5
votes
3answers
18k views

How do I configure IIS to allow access to network resources for PHP scripts?

I am currently working on a PHP front-end that joins together a series of applications running on separate servers; many of these applications generate files that I need access to, but these files (...
5
votes
5answers
3k views

Groups and Permissions: Nested UNIX groups

We are getting more and more outside developers (from different clients) and are beginning to need a better strategy than adhoc adding to our server and adding to them ourcompany group (which owns ...
5
votes
1answer
126 views

Is it possible to prevent users from removing jobs from the print queue?

I need to log all printed documents with their contents. I've enabled "Keep printed documents" in the relevant printers' properties. Now, I'm trying to prevent users from removing jobs from the ...
5
votes
2answers
11k views

How to give a user NTFS rights to a folder, via Powershell

I'm trying to build a script that will create a folder for a new user on our file server. Then take the inherited rights away from that folder and add specific rights back in. I have it successfully ...
4
votes
6answers
5k views

How to add a linux user with a random or invalid password from a script

I want to add a user to the linux system from a script, but I don't want to invent or care for the password. This should be done automatically. The goal is to generate ssh-keys and this user needs ...
4
votes
3answers
3k views

Backup data while keeping POSIX ACLs and permissions

I'm looking for a practical way to backup data from a server and keep all ACLs and permissions. I've looked at tar, but according to Google tar doesn't keep ACLs . I know rsync can keep ACLs and ...
4
votes
3answers
10k views

How to give write permissions to multiple users?

I have a web server and I'm uploading files using an FTP client. Because of that the owner and the group of the file are taken from the user used during the upload. Now I have to make this file ...
4
votes
3answers
10k views

Log file permissions in Linux

I am trying to write a simple script that monitors /var/log/messages file. The file by default doesn't have read permission for users, when I allow read access to this file my script works perfectly, ...
4
votes
4answers
14k views

Allowing non-admins to run programs as admins on Windows 7

On *nix, admins can use the setuid flag to allow non-admins to run certain programs that would otherwise require admin privileges. Is there any way to do something similar in Windows 7? This question ...
4
votes
4answers
1k views

How to restore remote access to a RHEL system from expanded permissions set over the entire filesystem? [duplicate]

Cause of the problem I intended to add group write permission on hidden files like '.hgignore' with the following: # pwd /opt # sudo chmod -R g+w .* The problem is that '..' matched this pattern, ...
4
votes
5answers
1k views

NTFS: Deny all permissions for all files, except where explicitly added

I'm running a sandboxed application as a local user. I now want to deny almost all file system permissions for this user to secure the system, except for a few working folders and some system DLLs (I'...
4
votes
3answers
1k views

Are Windows file permissions bound to the file, or the file system location?

Do Windows file permissions follow: The file, or... The file system location Say I have a file at "C:\MyFile.txt". I set some very specific permissions on this file. Later, I copy a new file ...
4
votes
2answers
153 views

What is the safest way to allow a developer to edit 3 Puppet modules?

We have a developer that has to make 3 Puppet modules for an environment. I want him to be able to write his 3 modules. We currently write our own modules and he is the first person from another ...
4
votes
4answers
2k views

Linux Web Server Permissions - Best Practices

On a privately owned server with one website, is there any reason the files/directories within /var/www can't be group owned by www-data? My understanding is that security risks with www-data having ...
4
votes
2answers
3k views

Fedora 16: “Permission denied: file permissions deny server access”

I'm working with a fresh Fedora 16 install and I'm trying to get Apache up and running. I'm very familiar with Linux and somewhat with CentOS, but I have very little experience with Fedora and SELinux ...
4
votes
4answers
55k views

List user's folder access permissions

I have a user in a domain who has access to multiple subfolders in multiple folders. His rights were defined pretty granularly. Now he's leaving the company but will continue to work for a firm as a ...
4
votes
2answers
2k views

Network Service account or domain account? [closed]

What are the pros and cons, or best practices when it comes to setting up applications on a server with either the Network Service account or a domain account? Are there some cases in which you'd do ...
4
votes
3answers
851 views

Active Directory delegation best practices

I am in the process of delegating some Active Directory tasks to a group of users. These users do not have domain administration rights and will only perform tasks such as creating/disabling accounts ...
4
votes
3answers
2k views

Any fast way to assign NTFS permissions to a folder with a very big amount of subfolders and files?

I'm trying to change NTFS permission to a folder containing a very big hierarchy below. I'm using the traditional approach (right mouse button, properties, security, etc) It's taking really long and I'...
4
votes
5answers
9k views

What rights does “Replicating Directory Changes” actually grant in Active Directory?

We need to grant a service ID the Replicating Directory Changes to Active Directory. People are concerned that we might accidentally let the service ID write data in Active Directory, or have ...
4
votes
2answers
8k views

Is it safe to delete “Account Unknown” entries from Windows ACLs in a domain environment?

It's not uncommon to see entries in Windows ACLs (NTFS files/folders, registry, AD objects, etc.) with the name "Account Unknown (SID)". Obviously these are because of old AD users or groups which at ...
4
votes
2answers
1k views

Prevent file from being changed under Linux

What's the command under Linux to mark a file as "locked"/to prevent any changes from being made to it? I'm not talking about chmod. There's a property that can be set (the name escapes me at the ...
4
votes
6answers
3k views

Scripts That Need (some) Root Access

I have a general question about system administration scripts that require "some" commands to be executed with root access, and other as a normal non-root user (ie myusername, etc.). I should mention ...
4
votes
1answer
867 views

How can I set the NTFS permissions on a folder for a WORM like behaviour

Is it possible to set group permission on a folder at a Windows server so that a file can be created, populated and closed, BUT not changed or deleted after that?
4
votes
2answers
16k views

Change owner recursively with Powershell?

I'm trying to use Powershell to change owner of a folder, recursively. I'm basically using this code: $acct1 = New-Object System.Security.Principal.NTAccount('DOMAIN\Enterprise Admins') $...