3

Is there any way to setup implicit deny for windows folder permissions? I would like to setup our accounting folders to only be accessed by the administrators group and the accounting group, and be denied by all other users (even ones that are created later). If possible I want to avoid having to put all the users that don't need access in a group but I don't want to accidently miss someone when creating the group and I don't want to have to remember to put new users in the group.

We are using Windows Small Business Server 2011.

Thanks in advance Branson

  • 2
    The default is already "deny". If there is no "allow" rule that matches, the user will not have access. – Simon Richter Apr 7 '16 at 2:35
4

It sounds like you have a good strategy with how you described it with out the Deny permission. If you setup an allow full access for Administrators and for the Accounting Group, anyone outside of that would already not have access to that folder. Generally Microsoft says to stay away from Deny permissions, since if one user is a member of an allowed group, but also a member of a deny group, the deny will win.

| improve this answer | |
  • 1
    I'd second that. While there are legitimate use cases for "deny" ACEs, this certainly is not one of them. Using an additional domain-local "Access_Accounting_Folders" group, allowing access exclusively for this group and adding other user groups as members is likely what the OP wants to have in terms of manageability. – the-wabbit Apr 6 '16 at 18:52
3

I agree with Nixphoe. Don't use Deny permissions. Use Allow permissions. Create a security group for all users that should have access, add the users to that group, and add the security group to the ACL of the folder in question.

| improve this answer | |
0

I concur with Nixphoe and offer a clarifying elaboration. Organizations often have a default group variously called All Users, Authenticated Users, or Everyone. It typically has read-only access to the entire folder structure. To achieve the stated aim it would be necessary to remove the group from the Accounting folders.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.