5

I have a folder which has permissions on it for our IIS user. This folder is currently shared so our code deployment user can move files onto it.

I attempted adding another user to the share through the folder properties>Sharing>Share and added a user there. Then IIS went down so I checked and sure enough it appeared that setting the share permissions removed the local folder permissions for the IIS user.

How do I add a user to the share without removing users from accessing it locally?

Improve this question

5 Answers 5

Reset to default
6

start over and create a local or domain group, and give the access for this new group. Any new users you need to give access to, you can just add them to this group.

Improve this answer
6
  • Good idea - it would have paid to have done it correctly the first time. But is this really the only solution?
    – Ziplin
    Apr 1, 2011 at 16:13
  • may be not.. though its really not much of an effort, and I suggest cleaning it up so you dont start looking for solutions again next time another user needs access.
    – whizkid
    Apr 1, 2011 at 16:21
  • +1 cause you're definitely right, Whizkid. This is actually the route I went. I think it's still a pretty valid problem to have, so I'm adding a bounty.
    – Ziplin
    Apr 6, 2011 at 15:50
  • if you are still looking for a solution here, I would need few more details, like, is the server is domain? are all the users mentioned here are local users (or any domain users)? also, check if you have removed inheritance on the folder
    – whizkid
    Apr 11, 2011 at 15:04
  • As far as "best-practices" go... you really should have 2 types of groups. Security Groups (which are used when defining permissions on shares & such) and User Groups (which is where you put the users) If you have 6 shares (1 for accounting, 1 for administration etc...) you create 6 Security Groups (one for each share) For each Dept in your office, you create a "User Group"... and perhaps additional ones for Adminstrators & supervisors. Assign the user to the User Group, put the user groups in security groups, and assign permissions to security groups.
    – TheCompWiz
    Apr 12, 2011 at 16:37
2
+25

Not sure exacrtly what you mean by "setting the share permissions removed the local folder permissions for the IIS user" (did the permission disappear, or just not get applied as expected?), but you should understand that Windows applies the most restrictive permission of the NTFS and Share permissions set on the object. Perhaps this explains what you experienced.

The Microsoft Technet article on Share and NTFS permissions in Windows 2008 suggests:

some experienced administrators prefer always to set share permissions to Full Control for Everyone, and to rely entirely on NTFS permissions to restrict access

This seems like a good standard approach to take, and in conjunction with whizkids suggestion to use groups reduces administrative overhead.

Improve this answer
1
  • 1
    The permissions actually disappeared, oddly enough
    – Ziplin
    Apr 12, 2011 at 14:07
2

I realise this is a 5 year old question, but I can verify the OP's problem. I have a folder with NTFS Security Permissions set to (MyServer/Users) group as IIS Application Identity is created in this group. I then added a share to the same folder, for remote file access. The website then crashed. Rechecking NTFS Security Permissions, and that group had been removed from the list previously set. TechNet says Share Permissions & NTFS Security Settings are seperate, changing one will not affect the other, but thats clearly not the case. We re-added the NTFS permissions for (MyServer/Users) group & it worked again. I guess its still a bug many years on.

Improve this answer
1

That's not expected behavior. I would test a couple other times and see if you can find the pattern. Adding a user through the GUI should never remove another user.

Did you change inheritance, or cleanup a user that had a GUID name, or something else at the same time? Or after creating the share, did you 'move' files over? Moving from the same volume will bring the original permissions with it and will not inherit.

I suspect that some other factor besides the share permission addition caused this to occur.

Improve this answer
1

Now an almost 9 year old question, and we just 'learned' the same thing. We have (2) local users set up with inherited read permissions, and local write permissions. If we share the folder, it removes the two users completely. We can put the permissions back after the share, but it definitely stripped them out.

If the local users have FULL CONTROL, it does not remove them. Alternatively, when doing the share, if we change access from CUSTOM to READ/WRITE, it also keeps, though changes, the permissions. We did not try other combinations.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .