2

I am developing some reporting for a series of Windows shares and I am not clear on the implementation details regarding permissions with deny types. While trying to calculate the resulting effective mask a user is subjected to after compensating for all share and ntfs permissions, it is not clear to me how to accomodate a deny type if present at the share level.

According to Permissions on a Shared Folder, the more restrictive permission takes precedence between the share and ntfs permissions and a deny type at the share level supersedes any permission at the ntfs level.

Consider the case where user-a has an explicit grant for Full Control at both the share and ntfs level.

If a group which user-a is a member of is added to the shares acl, any combination of a deny, Read, Change or Full Control manifests as no access at all for user-a. In addition, with the group set to Read on the share permission, user-a cannot delete a file if the path is known programmatically.

Effectively, if the context accessing a share acquires a deny of any mask, all access is denied based on my tests.

What is the use case for three mask options with a deny when the least restrictive (read) prevents all access entirely? I am aware that you can set finer grained permissions programmatically, however why expose even 3 from the UI when they all behave the same?

11
  • 1
    What is the use case for three mask options with a deny when the least restrictive (read) prevents all access. There isn't a use case.
    – Greg Askew
    Apr 2, 2019 at 13:54
  • There most certainly has to be a valid reason for this misleading implementation detail, I would love to know it. Feel free to write this up as an answer and thanks for the confirmation.
    – Ritmo2k
    Apr 2, 2019 at 14:11
  • Share Permissions and NTFS permissions come from different areas of thinking. Share permissions existed before NTFS came along, and are included for backwards compatibility with older Drive Formats (fat, fat32). As far as I am personally aware, if you have NTFS permissions, share permissions are set to Everyone and full access. NTFS permissions will then apply without any quirks.
    – Stese
    Apr 2, 2019 at 16:05
  • @Stese, it can sometimes be useful to have two shares pointing at the same directory, one of which is read-write and the other read-only. Also, setting the share permissions to "change" rather than "full control" can be a convenient way to prevent people messing with the file permissions, even for files they own. Apr 2, 2019 at 23:41
  • The reason there are three separate "deny" checkboxes is probably just that Microsoft wanted to use the user interface that already existed for file permissions, rather than trying to design and implement a new one. Apr 2, 2019 at 23:43

0

You must log in to answer this question.

Browse other questions tagged .