How to correct NTFS permissions set by OneDrive client?

Question

We use a Windows Server, which we want to get rid of in a few months. As replacement we configured SharePoint via Office 365, and we use the OneDrive client for synchronisation of files on the desktops.

To connect both, another OneDrive client is running on the Windows Server (an administrator keeps logged-in for this), so that files from the SharePoint library are temporarily also available via Windows share.

All files which are written by the OneDrive client onto the server, get restricted (wrong) permissions, so that unprivileged users can't access them via share. I desparately look for a solution to correct these permissions. (Server and PCs are in a .local domain, while Office is used with an .de domain, so both are accessed with different accounts.)

The following commands are executed as administrator on the file server:

D:\OneDrive\Company\Website - Library\Folder>dir /q File*
 Volume in drive D is Data1
 Volume Serial Number is E293-1932

 Directory of D:\OneDrive\Company\Website - Library\Folder

04.12.2023  15:00            17.740 COMPANY\adm_Name   File_written_via_share.docx
04.12.2023  15:00            17.741 COMPANY\adm_Name   File_written_via_SharePoint.docx
               2 File(s)         35.481 bytes
               0 Dir(s)  2.338.575.400.960 bytes free

D:\OneDrive\Company\Website - Library\Folder>icacls File*
File_written_via_share.docx COMPANY\Share_Company_RW:(I)(F)
                            BUILTIN\Administrators:(I)(F)
                            NT AUTHORITY\SYSTEM:(I)(F)
                            COMPANY\adm_Name:(I)(F)
                            BUILTIN\Users:(I)(RX)

File_written_via_SharePoint.docx NT AUTHORITY\SYSTEM:(I)(F)
                                 BUILTIN\Administrators:(I)(F)
                                 COMPANY\adm_Name:(I)(F)

Successfully processed 2 files; Failed processing 0 files

D:\OneDrive\Company\Website - Library\Folder>icacls File_written_via_SharePoint.docx /grant Users:(RX)
processed file: File_written_via_SharePoint.docx
Successfully processed 1 files; Failed processing 0 files

D:\OneDrive\Company\Website - Library\Folder>icacls File*
File_written_via_share.docx COMPANY\Share_Company_RW:(I)(F)
                            BUILTIN\Administrators:(I)(F)
                            NT AUTHORITY\SYSTEM:(I)(F)
                            COMPANY\adm_Name:(I)(F)
                            BUILTIN\Users:(I)(RX)

File_written_via_SharePoint.docx BUILTIN\Users:(RX)
                                 COMPANY\Share_Company_RW:(I)(F)
                                 BUILTIN\Administrators:(I)(F)
                                 NT AUTHORITY\SYSTEM:(I)(F)
                                 COMPANY\adm_Name:(I)(F)
                                 BUILTIN\Users:(I)(RX)

Successfully processed 2 files; Failed processing 0 files

I don't understand: How is it possible, that "icacls /grant Users" modifies the inherited ACL? Why are there two Users entries afterwards, but none before?

And more important: What can I do, that synchronyzed files get the same (inherited) ACL like files that were processed on the file server?

Thank you, Redoute

Answer 1

Let me see if I understand the scenario.

You copied your file server data to a document library in Sharepoint Online. Your users sync this document library with OneDrive.

You also sync this document library with OneDrive on the file server. You then share these files and make them available from the file server. As a result, the permissions on these files on the file server are getting messed up and users accessing these files from the server cannot access them.

If my understanding is correct then the answer is to stop doing that. If you've copied these files to a document library in Sharepoint Online then why do you need to make them available from the server? Choose one solution or the other. Either access these files solely from the document library in Sharepoint Online or solely from the file server, but not both.