For example, I have a group Department A. Among other users, I have a user named Boss. I want to create a file that can be changed only by Boss, and be readonly for the other users from that group.

I know that deny on the group level overrides allow on the user level so I can't do what I need just with share/ntfs permissions.

Here I see two solutions:

  1. Create a subgroup, for example, Department A without boss, deny that subgroup to write, and grant Department A permission to write. Will that work?
  2. Homer Simpson's approach. Set permissions individually for each user from a group.

Is there any elegant solution to this?

PS: OS is Windows 2003 Server

  • You should specify your OS to make the question clearer. – davidgo Mar 12 '13 at 6:44

Don't use deny. Instead:

  • Allow read for group "Department A"
  • Allow read+write for user "Boss"
| improve this answer | |
  • Thanks, that works. Meanwhile I did the Homer's way with powershell scripting by iterating through all users in "Department A" %) – Kzhi Mar 12 '13 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy