2

This question is, perhaps, slightly similar to this question, but the actual plan is different.

My goal is to create a "temp" share where people can off-load their data (for example, when they are getting ready to reinstall the OS or need to quickly share something with another employee).

Now, while a "temp" folder is by definition "temporary" and shouldn't be used for storing stuff long-term, I still want to maintain some security. To that end I'd like to grant my users (My.Domain\Domain Users) write access (create folders / files), and then modify / delete access only to the files / folders they, themselves, have created.

I suspect I'd need to make use of the "CREATOR OWNER" special principal. However, I feel that to restrict modify / delete capabilities, I'd need to explicitly add a deny permission to the NTFS security tab, and deny-rules, AFAIK, take precedent over allow-rules, so the CREATOR OWNER, even if granted full permission, wouldn't be able to actually make the changes.

Is what I'm trying to achieve at all possible?

  • What makes you think you need a deny permission? I don't see any reason for it. – Harry Johnston Nov 14 '18 at 1:45
  • @HarryJohnston As far as I've seen, if the "share" permissions are "read only", then users don't have write permissions even if NTFS allows it. And if the "share" permissions allow writing, then users can still delete, even if that permission isn't explicitly allowed in the NTFS settings. – Shaamaan Nov 14 '18 at 9:16
2

Here's the misunderstanding:

And if the "share" permissions allow writing, then users can still delete, even if that permission isn't explicitly allowed in the NTFS settings.

The share permissions never give you the ability to override the NTFS permissions. In order to perform a given action, you must have permission for that action on both the share and in NTFS. What you're probably seeing is the effect of the "Delete Subfolders and Files" right as mentioned in the answers to the linked question: you can delete a file if you have either the "Delete" right on the file or the "Delete Subfolders and Files" right on the folder containing the file. (The behaviour when deleting a folder is slightly more complicated, but the essentials are the same.)

The simplest way of resolving this problem is to give the users "Modify" on the parent folder rather than "Full Control".

So you want the NTFS permissions on the folder being shared to look like this:

  • Domain Users - Modify, this folder only
  • CREATOR OWNER - Full Control, all subfolders and files
  • Domain Users - Read/Execute, all subfolders and files (assuming that you want users to be able to read other user's files by default)
  • Administrators - Full Control, all subfolders and files (so that you can delete stuff if it becomes necessary to do so, e.g., files belonging to a user that has left)
|improve this answer|||||
  • I completely forgot about the "applies to" scope setting. Thanks for the clarification and a great answer! :) – Shaamaan Nov 15 '18 at 9:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.