We control access to our file shares using Security Groups in AD.


ZONE Group (Read & Execute, This Folder only) ZONE-Write Group (Modify, This folder, subfolders and files)

user "rick.deckard" is in the ZONE-Write Security Group and so has Modify access to the whole \ZONE folder.

If rick.deckard creates a directory


A "rick.deckard" ACE goes into the ACL for the BR1 directory, with "Full Control, This folder only".

If we subsequently remove "rick.deckard" from the ZONE-Write Security Group, he can't access the ZONE tree at all. Unless, he maps to \ZONE\BR1 direct and then he still has full control in that directory!

These user based ACE entries in ACL remain even after access via the Security Group has been revoked.

Is this normal behaviour?

How do we set up a "Security Group only" method of conferring access to the ZONE directory, whereby upon directory creation, specific user ACE's are not installed?

Any help would be appreciated.

  • 3
    You have Creator Owner in the ACL of the parent folder (Zone). Remove Creator Owner from the ACL of Zone. – joeqwerty Oct 20 '17 at 13:57
  • 1
    Joe's comment is spot on. Removing that will stop this from happening. Creator/Owner is a special group that does exactly this. It corresponds to the user SID that creates the object and grants them full control of it. – Kyp Oct 20 '17 at 22:55
  • 1
    Not many people realize this, but the same behavior exists for users creating objects in Active Directory. It's easy to lose control of who has access to what if you don't write some automation to clean it up. The creator owner ACE is everywhere (by design). – twconnell Oct 22 '17 at 9:52
  • Thank you for your comments. I removed the CREATOR OWNER ACE from the parent folder - and this prevented the user ACE entries being created when a user creates a sub-directory! As the removal of the CREATOR OWNER ACE was being propagated throughout the file system it also cleaned up the many existing user ACE entries from the tree. – spelk Oct 25 '17 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.