0

I'm asking for your help in setting permissions on a folder of my file server (Windows 2003 Server in a domain). I have a folder "A" that is writeable just for the user that created it. So any file and folder inside it are read only for other users. Now, he wants ALL users be able to write to a specific file in that folder. Others file and folder must continue to be read only. In that folder there are other files other than subfolders.

So, here's the question: What are the right permission I have to set to satisfy my user's request? Is it perhaps better to strcture that tree differently to keep things clean?

Thing I've tried are: - set write permission just for the file but obviously on saving it tells me "no no.. Wrong!" :) - set write permission for that folder only but than users are able to create files and folders... I need just that file writeble, nothing else.

I think, tell me if I'm wrong, that it is better to put that file in a sub folder and make that folder writeable to all users keeping the "Folder A" in read only for all and writeable for the owner...

----------

EDIT: Thank you all for answers! Now that I've understood which is the best practise... For a "didactic" purpose could you help me on setting that kind of permissions? I've spread lot of time yesterday trying to set working permission but no success =(

What I've done was: - User "owner" with modify permission on "Folder A" with hierarchy propagation enabled - the group with all user with read only on the "folder A" with hierarchy propagation enabled - the group that needs to write on the file in "folder A" with write (not modify) permissions on the file

This works well for a txt file. Not for a Office file.. I've discorvered (and now that i read all replies i see that you confirm this) that office when saves creates a tmp file and deletes the actual file... So what I can do? I have to give possibility to create files and delete files on that folder... But doing that users will be able to delete other files too and to create new files... Puah! What a mess!

Suggests?? =) Thank you very much!

Improve this question
3
  • It completely depends on the application. For some software, you may have no choice but to create a sub-directory.
    – Zoredache
    Dec 1, 2011 at 18:56
  • I take it from your edit that you've decided to modify the permissions on the file rather than put it in a separate folder?
    – Driftpeasant
    Dec 2, 2011 at 13:30
  • @Driftpeasant Oh no! It was just a match between me and ACEs to let things work properly (or almost) =). I've created a "test" structure that emulates the actual "folder A" and I've done tests on it .. Now I have to call my collegue and to structure its folder as best practice (and you) tells. The max I have obtained is: - Users can save the Excel file but can even create and delete other "Folder A" files. Although they cannot modify other "Folder A" files. I think that ACEs lesson could finish here! :)
    – Bianko
    Dec 2, 2011 at 13:53

3 Answers 3

Reset to default
1

@Driftpeasant's answer is a good one. The other thing associated with only granting access to a single file is that it can cause some serious application headaches. For example some apps will create temporary files in the same directory as the file (word) or will delete and recreate the file when saving (some mathematical applications, among others).

In the case of the delete and recreate this is very problematic as the newly created file will inherit the permissions from the folder, erasing whatever permissions changes were previously made. This is in line with @Zoredache's comment. I would suggest a folder or sub folder from that you want kept read only.

Improve this answer
3

You are correct - you're much better off moving that file to a separate folder that has read/write access for all users. Trying to lock down one file in a folder is a path to madness.

Improve this answer
4
  • No it's not. You can edit the ACL on a single file without issue. It's not very scalable and it's certainly not best practice, but it can be done without issue.
    – MDMarra
    Dec 1, 2011 at 17:02
  • 2
    No, you CAN. But what I said was that you're BETTER OFF not doing it, and that it's a path to madness, because it's difficult as heck to audit that later.
    – Driftpeasant
    Dec 1, 2011 at 17:10
  • 1
    I'll certainly agree that it's difficult to manage, but how is it difficult to audit? Failed access attempts will happily generate the same audit trail whether the failure is on a single file or a folder.
    – MDMarra
    Dec 1, 2011 at 17:16
  • 1
    I meant more when you go to generate a report for management or try to duplicate a user's permissions. One off permissions on a file in a folder with otherwise different permissions are a pain to deal with. Ultimately I guess I'm saying that technically this is entirely possible, but from a policy/management standpoint is exceedingly inadvisable.
    – Driftpeasant
    Dec 1, 2011 at 19:20
1

You should be able to set write permission to just the file. If you're receiving an error, you're doing it wrong. If you want clarification about what exactly you're doing wrong, you should edit your question to include what ACEs you're granting to what group in the ACL for that file as well as the error message that you receive.

Improve this answer
4
  • 4
    The problem with fixing permissions on a single file is that there is software with a saving process that will not work with permissions set on a single file. It is is not entirely unusual to see a program that when saving will: save new changes to temp file, delete old file, and rename temp file. It could be the program he is working with happens to use this method and is failing the save-as-temp file step.
    – Zoredache
    Dec 1, 2011 at 18:52
  • +10 on Zoredache here if I could.
    – Evan Anderson
    Dec 1, 2011 at 23:46
  • @EvanAnderson BUT YOU CAN'T :). Seriously, though - It sounded to me like it was failing to apply the actual permissions to the file. Certainly a valid point, though.
    – MDMarra
    Dec 1, 2011 at 23:48
  • I'd want to feedback as useful the Zoredache Reply but I can't or I'm not able to do it.. =)
    – Bianko
    Dec 2, 2011 at 11:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .