3

I am having permission problems with a folder on Windows Server 2012. At the root of the disk the following permissions are granted:

Principal           Access                      Inherited from  Applies to
Administrators      Full control                None            This folder, subfolders and files
SYSTEM              Full control                None            This folder, subfolders and files
CREATOR OWNER       Full control                None            Subfolders and files only
Users               Read & execute              None            This folder, subfolders and files
Users               Create folders/append data  None            This folder and subfolders
Users               Create files/write data     None            Subfolders only

The next subfolder is a shared disk folder (physical drive mounted to the folder with a share) with inheritance enabled (correctly includes all the root folder defined permissions) and the additional explicit permission granted of:

Principal           Access              Inherited from  Applies to
Users               Modify              None            Subfolders only

I was contacted by User1 who did not have permission to modify a file in a subfolder of the shared disk. When I checked the permissions of this subfolder this is what I see:

Principal           Access              Inherited from  Applies to
Administrators      Full control        Parent Object   This folder, subfolders and files
SYSTEM              Full control        D:\             This folder, subfolders and files
CREATOR OWNER       Full control        D:\             Subfolders and files only
Users               Read & execute      D:\             This folder, subfolders and files
Users               Special             D:\             This folder and subfolders
User2               Modify              Parent Object   This folder, subfolders and files

So the hierarchy looks like this:

\root disk
    \shared disk folder
        \problem subfolder

If inheritance is enabled, why is the Modify permission for the users group removed? And where is the User2 Modify permission coming from if it is not set on the parent folder?

I have tried changing the owner, disabling and re-enabling inheritance, but nothing short of configuring explicit permissions on the subfolder that should be inherited has worked. Anyone have any idea what is going on here?

Rob

1 Answer 1

2

This is your misunderstanding:

\root disk
    \shared disk folder
        \problem subfolder

Actually it looks like this:

\root of volume#1
     \junction to root of volume#2

\root of volume#2
     \problem subfolder

The root directory of a volume doesn't inherit permissions from a parent folder, because it doesn't have a parent folder. Mounting the volume "as if" it were a folder on another volume doesn't change this.

This is further confused by the fact that when you ask Explorer what the permissions on the junction are, it shows you the permissions for the junction itself - not the permissions from the volume that it is pointing to. Also, in a situation like this, it can get confused about where the inherited permissions are coming from.

To view and edit the permissions for the root directory of a volume that doesn't have a drive letter, open Computer Management (from Administrative Tools) and select the Disk Management tool. Right-click on the volume in question and select Properties, then go to the Security tab.

1
  • Right on the money, thank you!
    – Cirris
    Dec 14, 2019 at 0:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .