Windows SBS 2008 network share permissions

Question

I a windows server 2008 box that is used as a domain controller, SQL/Exhange server. this server also used to be the file server however i'v manged fight management for a server.

At the moment almost all the data is on the new server expect a few shares. and each client machine has been remapped via GPO's. after remapping everything and confirming people where new using the new server for files i removed all user access to the drives via right click -> security -> deny to stop people accessing the old data.

The way the drive had been set up the parent folder had been shared insted of the folders within,

example.

parent folder  
              -> office
              -> production

meaning i could not just share the drives.

However one of the old XP machines managed to evade the GPO updates. thus still had the old mapping. going to my computer and clicking on the drive gives access denied as expected as everyone has no rights to read/write there.

the user of this computer had a shortcut to a folder within the now inaccessible folder on their desktop.

but when they click on the short cut in to the folder it opens, and allows full control regardless of the permissions.

What's going on? am i just stupid? have i missed something?

p.s i'm not a server expert, i'v just been given these tasks with no prior experience. so everything i'v done thus far may not be the optimal way of doing it.

Answer 1

What's going on? am i just stupid? have i missed something?

This is most likely a result of the Bypass Traverse Checking user right, which every domain user account is granted by default. Bypass Traverse Checking allows a user to traverse a directory structure to which they don't have permission to get to a directory that they do have permission.

It sounds like you restricted access to the parent folders but not to the child folders.