We got very strange right problems on our server.
We have Common shares and we have enabled all rights for everyone on the
the share. Than we are giving proper security rights to groups.
Managers groups have write and read rights but Staff group have only
read rights.
When the staff login than can also write to the share. Why? What happen?


Marcus

Hello MarcusB,

What groups are set under share permissions with which rights? And also post
the the permissions form one problem folder for all groups added there.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> We got very strange right problems on our server.
> We have Common shares and we have enabled all rights for everyone on
> the
> the share. Than we are giving proper security rights to groups.
> Managers groups have write and read rights but Staff group have only
> read rights.
> When the staff login than can also write to the share. Why? What
> happen?
> Marcus
>

Under share permisions "everyone" have Full Control, change and read
permissions.

"Staff" group have in Security permission only read.

Thus staff should only have read permission. Which permision: Security
or Share take over?

/Marcus



Meinolf Weber wrote:
> Hello MarcusB,
>
> What groups are set under share permissions with which rights? And also
> post the the permissions form one problem folder for all groups added
> there.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> We got very strange right problems on our server.
>> We have Common shares and we have enabled all rights for everyone on
>> the
>> the share. Than we are giving proper security rights to groups.
>> Managers groups have write and read rights but Staff group have only
>> read rights.
>> When the staff login than can also write to the share. Why? What
>> happen?
>> Marcus
>>
>
>

Under the Security Tab > Advanced button, for NTFS settings, it will list
any group or individuals that have permissions and where they are inherited
from. Take a look at that to see if it explains where the Staff group is
getting their "write" rights.


"MarcusB" <marcusb@llunet.se> wrote in message
news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
> We got very strange right problems on our server.
> We have Common shares and we have enabled all rights for everyone on the
> the share. Than we are giving proper security rights to groups.
> Managers groups have write and read rights but Staff group have only read
> rights.
> When the staff login than can also write to the share. Why? What happen?
>
>
> Marcus

You really need to be more specific and provide more details such as the
folder structure and most importantly the NTFS permissions on the parent
folder as well as the sub folder. Are you sure there are no duplicate
memberships for both Managers/Staff?


"MarcusB" <marcusb@llunet.se> wrote in message
news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
> We got very strange right problems on our server.
> We have Common shares and we have enabled all rights for everyone on the
> the share. Than we are giving proper security rights to groups.
> Managers groups have write and read rights but Staff group have only read
> rights.
> When the staff login than can also write to the share. Why? What happen?
>
>
> Marcus

Under share permisions "everyone" have Full Control, change and read
permissions.

"Staff" group have in Security permission only read.

Thus staff should only have read permission and it have in the Security.
Which permision: Security or Share take over?
In my case it seems that Share permissions take over. How is it? It
should be that NTFS permission take over not oposit. Most restrictiv is
it not like that?

/Marcus

AllenM wrote:
> You really need to be more specific and provide more details such as the
> folder structure and most importantly the NTFS permissions on the parent
> folder as well as the sub folder. Are you sure there are no duplicate
> memberships for both Managers/Staff?
>
>
> "MarcusB" <marcusb@llunet.se> wrote in message
> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>> We got very strange right problems on our server.
>> We have Common shares and we have enabled all rights for everyone on the
>> the share. Than we are giving proper security rights to groups.
>> Managers groups have write and read rights but Staff group have only read
>> rights.
>> When the staff login than can also write to the share. Why? What happen?
>>
>>
>> Marcus
>
>

According Microsoft:
When folders on NTFS volumes are shared, the effective permission of the
user will be the most restrictive of the NTFS and share permissions.

But it is not in my case:
Share permission: "Evereone" full rights
NTFS Permission : "Staff" read.

Effective permission are Staff full rights.

Why?

/Marcus

MarcusB wrote:
> Under share permisions "everyone" have Full Control, change and read
> permissions.
>
> "Staff" group have in Security permission only read.
>
> Thus staff should only have read permission and it have in the Security.
> Which permision: Security or Share take over?
> In my case it seems that Share permissions take over. How is it? It
> should be that NTFS permission take over not oposit. Most restrictiv is
> it not like that?
>
> /Marcus
>
> AllenM wrote:
>> You really need to be more specific and provide more details such as
>> the folder structure and most importantly the NTFS permissions on the
>> parent folder as well as the sub folder. Are you sure there are no
>> duplicate memberships for both Managers/Staff?
>>
>>
>> "MarcusB" <marcusb@llunet.se> wrote in message
>> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>> We got very strange right problems on our server.
>>> We have Common shares and we have enabled all rights for everyone on
>>> the the share. Than we are giving proper security rights to groups.
>>> Managers groups have write and read rights but Staff group have only
>>> read rights.
>>> When the staff login than can also write to the share. Why? What happen?
>>>
>>>
>>> Marcus
>>
>>

Share security is correct. Everyone should have "FULL". Here's how SHARE
permissions work in unison with NTFS permissions.

SHARE permissions will "superceed" NTFS folder and file permissions with the
"least" permissive access. Example: If you set EVERYONE with "READ" onyl on
the SHARE then it will not matter what NFTS permissions you give them they
will only have READ permissions. That said is the reason when you share a
folder you give EVERYONE-FULL.
Now NTFS permissions will override each other with the "most" permissive
access. Example. If user A belong to Group A-Modify as well as Group B-Read
only then they will receive the "most" permissive which is Modify.

Given all of this I'd like to see all of the groups as well as their
permissions on the folder in question.


"MarcusB" <marcusb@llunet.se> wrote in message
news:Oje8TqtrIHA.4492@TK2MSFTNGP02.phx.gbl...
> Under share permisions "everyone" have Full Control, change and read
> permissions.
>
> "Staff" group have in Security permission only read.
>
> Thus staff should only have read permission and it have in the Security.
> Which permision: Security or Share take over?
> In my case it seems that Share permissions take over. How is it? It should
> be that NTFS permission take over not oposit. Most restrictiv is it not
> like that?
>
> /Marcus
>
> AllenM wrote:
>> You really need to be more specific and provide more details such as the
>> folder structure and most importantly the NTFS permissions on the parent
>> folder as well as the sub folder. Are you sure there are no duplicate
>> memberships for both Managers/Staff?
>>
>>
>> "MarcusB" <marcusb@llunet.se> wrote in message
>> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>> We got very strange right problems on our server.
>>> We have Common shares and we have enabled all rights for everyone on the
>>> the share. Than we are giving proper security rights to groups.
>>> Managers groups have write and read rights but Staff group have only
>>> read rights.
>>> When the staff login than can also write to the share. Why? What happen?
>>>
>>>
>>> Marcus
>>

It is difficult, if not impossible, to help you further if you don't answer
the follow-up questions that you get here. Myself and AllenM asked about
parent folders and inherited permissions. If you answer those questions we
could probably help you further.



"MarcusB" <marcusb@llunet.se> wrote in message
news:Oje8TqtrIHA.4492@TK2MSFTNGP02.phx.gbl...
> Under share permisions "everyone" have Full Control, change and read
> permissions.
>
> "Staff" group have in Security permission only read.
>
> Thus staff should only have read permission and it have in the Security.
> Which permision: Security or Share take over?
> In my case it seems that Share permissions take over. How is it? It should
> be that NTFS permission take over not oposit. Most restrictiv is it not
> like that?
>
> /Marcus
>
> AllenM wrote:
>> You really need to be more specific and provide more details such as the
>> folder structure and most importantly the NTFS permissions on the parent
>> folder as well as the sub folder. Are you sure there are no duplicate
>> memberships for both Managers/Staff?
>>
>>
>> "MarcusB" <marcusb@llunet.se> wrote in message
>> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>> We got very strange right problems on our server.
>>> We have Common shares and we have enabled all rights for everyone on the
>>> the share. Than we are giving proper security rights to groups.
>>> Managers groups have write and read rights but Staff group have only
>>> read rights.
>>> When the staff login than can also write to the share. Why? What happen?
>>>
>>>
>>> Marcus
>>

The parent folder is disk "X:"
THere is in Security:
Administrators: FULL Control
Everyone :READ & Execute
SYSTEM : FULL Control
CREATOR OWNER
USERS : READ

The problematic folder is the folder under drive X and is called "confident"

THere is in Security:
Administrators: FULL Control
Everyone :READ & Execute
SYSTEM : FULL Control
CREATOR OWNER
USERS : READ
STAFF: READ
Managers: FULL Control

Share is:
Everyone: Full Control


Users who belongs to the STAFF belongs also to Domain Users.

STAFF and Managers are Universal groups in the domain.


To make sharing easier we gave "Everyone" Full rights and we wanted to
manage rioghts by NTFS but it is not working like it should. Shares
rights wins?

Can you help now?

/Marcus



JohnB wrote:
> It is difficult, if not impossible, to help you further if you don't answer
> the follow-up questions that you get here. Myself and AllenM asked about
> parent folders and inherited permissions. If you answer those questions we
> could probably help you further.
>
>
>
> "MarcusB" <marcusb@llunet.se> wrote in message
> news:Oje8TqtrIHA.4492@TK2MSFTNGP02.phx.gbl...
>> Under share permisions "everyone" have Full Control, change and read
>> permissions.
>>
>> "Staff" group have in Security permission only read.
>>
>> Thus staff should only have read permission and it have in the Security.
>> Which permision: Security or Share take over?
>> In my case it seems that Share permissions take over. How is it? It should
>> be that NTFS permission take over not oposit. Most restrictiv is it not
>> like that?
>>
>> /Marcus
>>
>> AllenM wrote:
>>> You really need to be more specific and provide more details such as the
>>> folder structure and most importantly the NTFS permissions on the parent
>>> folder as well as the sub folder. Are you sure there are no duplicate
>>> memberships for both Managers/Staff?
>>>
>>>
>>> "MarcusB" <marcusb@llunet.se> wrote in message
>>> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>>> We got very strange right problems on our server.
>>>> We have Common shares and we have enabled all rights for everyone on the
>>>> the share. Than we are giving proper security rights to groups.
>>>> Managers groups have write and read rights but Staff group have only
>>>> read rights.
>>>> When the staff login than can also write to the share. Why? What happen?
>>>>
>>>>
>>>> Marcus
>