0

Environment: No Active Directory and no Domain Controller. Server is Win 2008

I have a directory with only ALLOW permissions set (no DENY permission)..and no inherited permissions. I have two groups(Administrators and CoOwners) set to Full control. However, the members of that group are not able to view/modify the folder.

If I explicitly add the 'Administrator' with full permissions, for example, then that user can access/modify fine. Why isn't giving the GROUP permission giving the members of that group the access I would expect?

Any input/suggestions are appreciated.

6
  • Are you testing this over the network or from an interactive logon?
    – Nic
    Jan 22, 2011 at 2:12
  • 2
    In your testing, I am guessing you added users to the CoOwners group? Did you logout and login again? Groups membership is only checked when the user first logs in / connects.
    – Zoredache
    Jan 22, 2011 at 2:23
  • Login/logout from what? Reboot the server(ugh) or the machine I'm trying to access from(Server or Win7 or XP)?
    – Russ
    Jan 22, 2011 at 3:27
  • What are the permissions on the parent folders? Are these users or groups permitted to traverse the tree to reach the target? Jan 24, 2011 at 1:57
  • Russ, can you post screenshots of your share permissions and NTFS permissions on the shared folder? (And regarding the comment by Zoredache, rebooting either the client OR server should do the trick.)
    – Nic
    Jan 24, 2011 at 3:59

2 Answers 2

1

At a guess, I would say that group membership hasn't been established yet.

When you establish an SMB connection with a server, that's when the server determines which groups you are a part of. Changes to group membership won't take effect until the SMB connection is reset. Use the whoami tool to verify this.

> whoami /groups

You can get a list of open sessions using the Share and Storage Management administrative tool, and you can even close an SMB session right there, which makes testing much faster.

Update: It is usually a good idea to only assign permissions at the NTFS level. Try changing your share permissions to allow "Full Control" for "Everyone" to eliminate one possible cause.

2
  • When I run whoami /groups, it says my ID (I am logged in as 'Administrator') is in a bunch of groups including 'Administrators'. What are you suggesting I try to verify I my credentials are correct? thanks.
    – Russ
    Jan 22, 2011 at 3:20
  • If you've set up the ACL on your shared folder so that "CoOwners" has full control, then you want to make sure that "CoOwners" also appears in whoami.
    – Nic
    Jan 24, 2011 at 4:02
-3

Because in a GPO ( wheter have AD or not, windows O.S.s have GPOs ;) ) top-level permissions always overrides lover levels. And if there is no specific policy, the behaviour will be "Always Deny". In ths case when you explicitly add "Administrator" whis is a user, overrides the policy for "Administrators" which is a group and voila, you get your permissions. When you dont add, group policy grants that permission but default user permission ( for admin e.g ) overrides and denies it... BUT, when you give "Ownership"... This is what you need :) It always overrides defaults ;) ( and of course unless you explicitly add any user ;) as i mentioned above top-level policies ALWAYS overrides lover level policies ;) )

7
  • 1
    Less emoticons and more answer in the future. Jan 22, 2011 at 2:31
  • I'm sorry, this is incorrect. Not all operating systems have group policy; maybe you're thinking of ACLs? Top level permissions will apply to the descendents when inheritance is enabled, but they never "override" lower levels.
    – Nic
    Jan 22, 2011 at 2:32
  • i was talking about windows operating systems.was i wrong?actually,yes,sorry,advanced security options came with ntfs and my assumption covers win2k and after.and by top-level,i must be wrote upside-down,i was mentioning not base but derived policies.like if a "group" policy is low-level,a "user" policy will be top-level (and this should be reversed if i'm wrong).so if there is no ownership and no specific permission,the policy will be defaultly 'deny' right?so this is my base (low level).and if i enter a user right (this is my top level) it overrides base and runs the actual user right,right? Jan 22, 2011 at 2:40
  • I am using Win Server 2008. I wonder if there is any conflict between 'Permissions' and 'Sharing options'. Both are only trying to give access to the folder to Administrators and CoOwners. Note that I am accessing the WinServer2008 shared folder from the WinServer2008 machine, a Win7 machine, and an XP machine.
    – Russ
    Jan 22, 2011 at 3:24
  • Not a clear answer, though I do like the idea of "lover-level policies". @ErnieTheGeek, you mean "fewer emoticons", not "less emoticons". ;)
    – hmallett
    Jan 22, 2011 at 13:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .