Stange share rights problems

We got very strange right problems on our server.
We have Common shares and we have enabled all rights for everyone on the
the share. Than we are giving proper security rights to groups.
Managers groups have write and read rights but Staff group have only
read rights.
When the staff login than can also write to the share. Why? What happen?


Marcus

Meinolf
Mon May 05 07:54:44 PDT 2008

Hello MarcusB,

What groups are set under share permissions with which rights? And also post
the the permissions form one problem folder for all groups added there.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> We got very strange right problems on our server.
> We have Common shares and we have enabled all rights for everyone on
> the
> the share. Than we are giving proper security rights to groups.
> Managers groups have write and read rights but Staff group have only
> read rights.
> When the staff login than can also write to the share. Why? What
> happen?
> Marcus
>

MarcusB
Mon May 05 10:25:03 PDT 2008

Under share permisions "everyone" have Full Control, change and read
permissions.

"Staff" group have in Security permission only read.

Thus staff should only have read permission. Which permision: Security
or Share take over?

/Marcus



Meinolf Weber wrote:
> Hello MarcusB,
>
> What groups are set under share permissions with which rights? And also
> post the the permissions form one problem folder for all groups added
> there.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> We got very strange right problems on our server.
>> We have Common shares and we have enabled all rights for everyone on
>> the
>> the share. Than we are giving proper security rights to groups.
>> Managers groups have write and read rights but Staff group have only
>> read rights.
>> When the staff login than can also write to the share. Why? What
>> happen?
>> Marcus
>>
>
>

JohnB
Mon May 05 10:43:21 PDT 2008

Under the Security Tab > Advanced button, for NTFS settings, it will list
any group or individuals that have permissions and where they are inherited
from. Take a look at that to see if it explains where the Staff group is
getting their "write" rights.


"MarcusB" <marcusb@llunet.se> wrote in message
news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
> We got very strange right problems on our server.
> We have Common shares and we have enabled all rights for everyone on the
> the share. Than we are giving proper security rights to groups.
> Managers groups have write and read rights but Staff group have only read
> rights.
> When the staff login than can also write to the share. Why? What happen?
>
>
> Marcus

AllenM
Mon May 05 10:49:30 PDT 2008

You really need to be more specific and provide more details such as the
folder structure and most importantly the NTFS permissions on the parent
folder as well as the sub folder. Are you sure there are no duplicate
memberships for both Managers/Staff?


"MarcusB" <marcusb@llunet.se> wrote in message
news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
> We got very strange right problems on our server.
> We have Common shares and we have enabled all rights for everyone on the
> the share. Than we are giving proper security rights to groups.
> Managers groups have write and read rights but Staff group have only read
> rights.
> When the staff login than can also write to the share. Why? What happen?
>
>
> Marcus

MarcusB
Mon May 05 11:05:16 PDT 2008


Under share permisions "everyone" have Full Control, change and read
permissions.

"Staff" group have in Security permission only read.

Thus staff should only have read permission and it have in the Security.
Which permision: Security or Share take over?
In my case it seems that Share permissions take over. How is it? It
should be that NTFS permission take over not oposit. Most restrictiv is
it not like that?

/Marcus

AllenM wrote:
> You really need to be more specific and provide more details such as the
> folder structure and most importantly the NTFS permissions on the parent
> folder as well as the sub folder. Are you sure there are no duplicate
> memberships for both Managers/Staff?
>
>
> "MarcusB" <marcusb@llunet.se> wrote in message
> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>> We got very strange right problems on our server.
>> We have Common shares and we have enabled all rights for everyone on the
>> the share. Than we are giving proper security rights to groups.
>> Managers groups have write and read rights but Staff group have only read
>> rights.
>> When the staff login than can also write to the share. Why? What happen?
>>
>>
>> Marcus
>
>

MarcusB
Mon May 05 11:14:58 PDT 2008

According Microsoft:
When folders on NTFS volumes are shared, the effective permission of the
user will be the most restrictive of the NTFS and share permissions.

But it is not in my case:
Share permission: "Evereone" full rights
NTFS Permission : "Staff" read.

Effective permission are Staff full rights.

Why?

/Marcus

MarcusB wrote:
> Under share permisions "everyone" have Full Control, change and read
> permissions.
>
> "Staff" group have in Security permission only read.
>
> Thus staff should only have read permission and it have in the Security.
> Which permision: Security or Share take over?
> In my case it seems that Share permissions take over. How is it? It
> should be that NTFS permission take over not oposit. Most restrictiv is
> it not like that?
>
> /Marcus
>
> AllenM wrote:
>> You really need to be more specific and provide more details such as
>> the folder structure and most importantly the NTFS permissions on the
>> parent folder as well as the sub folder. Are you sure there are no
>> duplicate memberships for both Managers/Staff?
>>
>>
>> "MarcusB" <marcusb@llunet.se> wrote in message
>> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>> We got very strange right problems on our server.
>>> We have Common shares and we have enabled all rights for everyone on
>>> the the share. Than we are giving proper security rights to groups.
>>> Managers groups have write and read rights but Staff group have only
>>> read rights.
>>> When the staff login than can also write to the share. Why? What happen?
>>>
>>>
>>> Marcus
>>
>>

AllenM
Mon May 05 11:20:50 PDT 2008

Share security is correct. Everyone should have "FULL". Here's how SHARE
permissions work in unison with NTFS permissions.

SHARE permissions will "superceed" NTFS folder and file permissions with the
"least" permissive access. Example: If you set EVERYONE with "READ" onyl on
the SHARE then it will not matter what NFTS permissions you give them they
will only have READ permissions. That said is the reason when you share a
folder you give EVERYONE-FULL.
Now NTFS permissions will override each other with the "most" permissive
access. Example. If user A belong to Group A-Modify as well as Group B-Read
only then they will receive the "most" permissive which is Modify.

Given all of this I'd like to see all of the groups as well as their
permissions on the folder in question.


"MarcusB" <marcusb@llunet.se> wrote in message
news:Oje8TqtrIHA.4492@TK2MSFTNGP02.phx.gbl...
> Under share permisions "everyone" have Full Control, change and read
> permissions.
>
> "Staff" group have in Security permission only read.
>
> Thus staff should only have read permission and it have in the Security.
> Which permision: Security or Share take over?
> In my case it seems that Share permissions take over. How is it? It should
> be that NTFS permission take over not oposit. Most restrictiv is it not
> like that?
>
> /Marcus
>
> AllenM wrote:
>> You really need to be more specific and provide more details such as the
>> folder structure and most importantly the NTFS permissions on the parent
>> folder as well as the sub folder. Are you sure there are no duplicate
>> memberships for both Managers/Staff?
>>
>>
>> "MarcusB" <marcusb@llunet.se> wrote in message
>> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>> We got very strange right problems on our server.
>>> We have Common shares and we have enabled all rights for everyone on the
>>> the share. Than we are giving proper security rights to groups.
>>> Managers groups have write and read rights but Staff group have only
>>> read rights.
>>> When the staff login than can also write to the share. Why? What happen?
>>>
>>>
>>> Marcus
>>

JohnB
Mon May 05 11:35:58 PDT 2008

It is difficult, if not impossible, to help you further if you don't answer
the follow-up questions that you get here. Myself and AllenM asked about
parent folders and inherited permissions. If you answer those questions we
could probably help you further.



"MarcusB" <marcusb@llunet.se> wrote in message
news:Oje8TqtrIHA.4492@TK2MSFTNGP02.phx.gbl...
> Under share permisions "everyone" have Full Control, change and read
> permissions.
>
> "Staff" group have in Security permission only read.
>
> Thus staff should only have read permission and it have in the Security.
> Which permision: Security or Share take over?
> In my case it seems that Share permissions take over. How is it? It should
> be that NTFS permission take over not oposit. Most restrictiv is it not
> like that?
>
> /Marcus
>
> AllenM wrote:
>> You really need to be more specific and provide more details such as the
>> folder structure and most importantly the NTFS permissions on the parent
>> folder as well as the sub folder. Are you sure there are no duplicate
>> memberships for both Managers/Staff?
>>
>>
>> "MarcusB" <marcusb@llunet.se> wrote in message
>> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>> We got very strange right problems on our server.
>>> We have Common shares and we have enabled all rights for everyone on the
>>> the share. Than we are giving proper security rights to groups.
>>> Managers groups have write and read rights but Staff group have only
>>> read rights.
>>> When the staff login than can also write to the share. Why? What happen?
>>>
>>>
>>> Marcus
>>

MarcusB
Mon May 05 11:57:17 PDT 2008

The parent folder is disk "X:"
THere is in Security:
Administrators: FULL Control
Everyone :READ & Execute
SYSTEM : FULL Control
CREATOR OWNER
USERS : READ

The problematic folder is the folder under drive X and is called "confident"

THere is in Security:
Administrators: FULL Control
Everyone :READ & Execute
SYSTEM : FULL Control
CREATOR OWNER
USERS : READ
STAFF: READ
Managers: FULL Control

Share is:
Everyone: Full Control


Users who belongs to the STAFF belongs also to Domain Users.

STAFF and Managers are Universal groups in the domain.


To make sharing easier we gave "Everyone" Full rights and we wanted to
manage rioghts by NTFS but it is not working like it should. Shares
rights wins?

Can you help now?

/Marcus



JohnB wrote:
> It is difficult, if not impossible, to help you further if you don't answer
> the follow-up questions that you get here. Myself and AllenM asked about
> parent folders and inherited permissions. If you answer those questions we
> could probably help you further.
>
>
>
> "MarcusB" <marcusb@llunet.se> wrote in message
> news:Oje8TqtrIHA.4492@TK2MSFTNGP02.phx.gbl...
>> Under share permisions "everyone" have Full Control, change and read
>> permissions.
>>
>> "Staff" group have in Security permission only read.
>>
>> Thus staff should only have read permission and it have in the Security.
>> Which permision: Security or Share take over?
>> In my case it seems that Share permissions take over. How is it? It should
>> be that NTFS permission take over not oposit. Most restrictiv is it not
>> like that?
>>
>> /Marcus
>>
>> AllenM wrote:
>>> You really need to be more specific and provide more details such as the
>>> folder structure and most importantly the NTFS permissions on the parent
>>> folder as well as the sub folder. Are you sure there are no duplicate
>>> memberships for both Managers/Staff?
>>>
>>>
>>> "MarcusB" <marcusb@llunet.se> wrote in message
>>> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>>> We got very strange right problems on our server.
>>>> We have Common shares and we have enabled all rights for everyone on the
>>>> the share. Than we are giving proper security rights to groups.
>>>> Managers groups have write and read rights but Staff group have only
>>>> read rights.
>>>> When the staff login than can also write to the share. Why? What happen?
>>>>
>>>>
>>>> Marcus
>

AllenM
Mon May 05 12:38:18 PDT 2008

No. SHARE rights only win if it is less permissive.(or most restricted as
other may say). from the looks of it it is a bit unorganized and messy but I
don't see anything in there that could allow "STAFF" the ability to wrtie to
the folder. You are sure all STAFF members can write to the folder? Is it
isolated to a single user who may be a memebr of Administrators and or
MANAGERS?

Here is what I would do.

1. First of all verify and confirm that the user who has the ability to
write to the sub folder is not a member of the Administrators or Managers
group.
2. Is the sub folder SHARED also? What are the permissions there?
3. Turn off inheritance on the sub folders. Clean your NTFS folder
structure. No need for EVERYONE to be listed in an y sub folders.

Parent Folder
Administrators = FULL
SYSTEM = FULL
Everyone = List

Sub Folder - TURN OFF INHERITANCE AND COPY
Administrators = FULL
SYSTEM = FULL
Staff = Read
Managers = FULL

Also one more quick question. When you say the parent folder is X is that
the root?



"MarcusB" <marcusb@llunet.se> wrote in message
news:uJuoYHurIHA.1952@TK2MSFTNGP05.phx.gbl...
> The parent folder is disk "X:"
> THere is in Security:
> Administrators: FULL Control
> Everyone :READ & Execute
> SYSTEM : FULL Control
> CREATOR OWNER
> USERS : READ
>
> The problematic folder is the folder under drive X and is called
> "confident"
>
> THere is in Security:
> Administrators: FULL Control
> Everyone :READ & Execute
> SYSTEM : FULL Control
> CREATOR OWNER
> USERS : READ
> STAFF: READ
> Managers: FULL Control
>
> Share is:
> Everyone: Full Control
>
>
> Users who belongs to the STAFF belongs also to Domain Users.
>
> STAFF and Managers are Universal groups in the domain.
>
>
> To make sharing easier we gave "Everyone" Full rights and we wanted to
> manage rioghts by NTFS but it is not working like it should. Shares rights
> wins?
>
> Can you help now?
>
> /Marcus
>
>
>
> JohnB wrote:
>> It is difficult, if not impossible, to help you further if you don't
>> answer the follow-up questions that you get here. Myself and AllenM
>> asked about parent folders and inherited permissions. If you answer
>> those questions we could probably help you further.
>>
>>
>>
>> "MarcusB" <marcusb@llunet.se> wrote in message
>> news:Oje8TqtrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>> Under share permisions "everyone" have Full Control, change and read
>>> permissions.
>>>
>>> "Staff" group have in Security permission only read.
>>>
>>> Thus staff should only have read permission and it have in the Security.
>>> Which permision: Security or Share take over?
>>> In my case it seems that Share permissions take over. How is it? It
>>> should be that NTFS permission take over not oposit. Most restrictiv is
>>> it not like that?
>>>
>>> /Marcus
>>>
>>> AllenM wrote:
>>>> You really need to be more specific and provide more details such as
>>>> the folder structure and most importantly the NTFS permissions on the
>>>> parent folder as well as the sub folder. Are you sure there are no
>>>> duplicate memberships for both Managers/Staff?
>>>>
>>>>
>>>> "MarcusB" <marcusb@llunet.se> wrote in message
>>>> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>>>> We got very strange right problems on our server.
>>>>> We have Common shares and we have enabled all rights for everyone on
>>>>> the the share. Than we are giving proper security rights to groups.
>>>>> Managers groups have write and read rights but Staff group have only
>>>>> read rights.
>>>>> When the staff login than can also write to the share. Why? What
>>>>> happen?
>>>>>
>>>>>
>>>>> Marcus
>>

JohnB
Mon May 05 12:49:05 PDT 2008

Marcus,
The effective rights of the combination of Shared and NTFS permissions are
the most restrictive of the combination of the assigned rights.
And as you're saying, things aren't what they should be.
To get to the bottom of this, we need to know where Staff are getting their
permissions from.

Have you tested this with all users from the Staff Group?

Under the Security Tab > Advanced button - on the row for Staff, what does
it have under:
- the Inherited column?
- the Permission column?





"MarcusB" <marcusb@llunet.se> wrote in message
news:uJuoYHurIHA.1952@TK2MSFTNGP05.phx.gbl...
> The parent folder is disk "X:"
> THere is in Security:
> Administrators: FULL Control
> Everyone :READ & Execute
> SYSTEM : FULL Control
> CREATOR OWNER
> USERS : READ
>
> The problematic folder is the folder under drive X and is called
> "confident"
>
> THere is in Security:
> Administrators: FULL Control
> Everyone :READ & Execute
> SYSTEM : FULL Control
> CREATOR OWNER
> USERS : READ
> STAFF: READ
> Managers: FULL Control
>
> Share is:
> Everyone: Full Control
>
>
> Users who belongs to the STAFF belongs also to Domain Users.
>
> STAFF and Managers are Universal groups in the domain.
>
>
> To make sharing easier we gave "Everyone" Full rights and we wanted to
> manage rioghts by NTFS but it is not working like it should. Shares rights
> wins?
>
> Can you help now?
>
> /Marcus
>
>
>
> JohnB wrote:
>> It is difficult, if not impossible, to help you further if you don't
>> answer the follow-up questions that you get here. Myself and AllenM
>> asked about parent folders and inherited permissions. If you answer
>> those questions we could probably help you further.
>>
>>
>>
>> "MarcusB" <marcusb@llunet.se> wrote in message
>> news:Oje8TqtrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>> Under share permisions "everyone" have Full Control, change and read
>>> permissions.
>>>
>>> "Staff" group have in Security permission only read.
>>>
>>> Thus staff should only have read permission and it have in the Security.
>>> Which permision: Security or Share take over?
>>> In my case it seems that Share permissions take over. How is it? It
>>> should be that NTFS permission take over not oposit. Most restrictiv is
>>> it not like that?
>>>
>>> /Marcus
>>>
>>> AllenM wrote:
>>>> You really need to be more specific and provide more details such as
>>>> the folder structure and most importantly the NTFS permissions on the
>>>> parent folder as well as the sub folder. Are you sure there are no
>>>> duplicate memberships for both Managers/Staff?
>>>>
>>>>
>>>> "MarcusB" <marcusb@llunet.se> wrote in message
>>>> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>>>> We got very strange right problems on our server.
>>>>> We have Common shares and we have enabled all rights for everyone on
>>>>> the the share. Than we are giving proper security rights to groups.
>>>>> Managers groups have write and read rights but Staff group have only
>>>>> read rights.
>>>>> When the staff login than can also write to the share. Why? What
>>>>> happen?
>>>>>
>>>>>
>>>>> Marcus
>>

MarcusB
Tue May 06 00:06:14 PDT 2008

AllenM wrote:
> No. SHARE rights only win if it is less permissive.(or most restricted as
> other may say). from the looks of it it is a bit unorganized and messy but I
> don't see anything in there that could allow "STAFF" the ability to wrtie to
> the folder. You are sure all STAFF members can write to the folder? Is it
> isolated to a single user who may be a memebr of Administrators and or
> MANAGERS?
>
> Here is what I would do.
>
> 1. First of all verify and confirm that the user who has the ability to
> write to the sub folder is not a member of the Administrators or Managers
> group.

The Staff is not member of the Administrators or Managers

> 2. Is the sub folder SHARED also? What are the permissions there?
No subfolders shared. The only Confident folder is shared.

> 3. Turn off inheritance on the sub folders. Clean your NTFS folder
> structure. No need for EVERYONE to be listed in an y sub folders.
>
I turned off inheritance and after it everything started to work like it
should. Very strange. Staff did not have write right on the root.


/Marcus
> Parent Folder
> Administrators = FULL
> SYSTEM = FULL
> Everyone = List
>
> Sub Folder - TURN OFF INHERITANCE AND COPY
> Administrators = FULL
> SYSTEM = FULL
> Staff = Read
> Managers = FULL
>
> Also one more quick question. When you say the parent folder is X is that
> the root?
>
>
>
> "MarcusB" <marcusb@llunet.se> wrote in message
> news:uJuoYHurIHA.1952@TK2MSFTNGP05.phx.gbl...
>> The parent folder is disk "X:"
>> THere is in Security:
>> Administrators: FULL Control
>> Everyone :READ & Execute
>> SYSTEM : FULL Control
>> CREATOR OWNER
>> USERS : READ
>>
>> The problematic folder is the folder under drive X and is called
>> "confident"
>>
>> THere is in Security:
>> Administrators: FULL Control
>> Everyone :READ & Execute
>> SYSTEM : FULL Control
>> CREATOR OWNER
>> USERS : READ
>> STAFF: READ
>> Managers: FULL Control
>>
>> Share is:
>> Everyone: Full Control
>>
>>
>> Users who belongs to the STAFF belongs also to Domain Users.
>>
>> STAFF and Managers are Universal groups in the domain.
>>
>>
>> To make sharing easier we gave "Everyone" Full rights and we wanted to
>> manage rioghts by NTFS but it is not working like it should. Shares rights
>> wins?
>>
>> Can you help now?
>>
>> /Marcus
>>
>>
>>
>> JohnB wrote:
>>> It is difficult, if not impossible, to help you further if you don't
>>> answer the follow-up questions that you get here. Myself and AllenM
>>> asked about parent folders and inherited permissions. If you answer
>>> those questions we could probably help you further.
>>>
>>>
>>>
>>> "MarcusB" <marcusb@llunet.se> wrote in message
>>> news:Oje8TqtrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>>> Under share permisions "everyone" have Full Control, change and read
>>>> permissions.
>>>>
>>>> "Staff" group have in Security permission only read.
>>>>
>>>> Thus staff should only have read permission and it have in the Security.
>>>> Which permision: Security or Share take over?
>>>> In my case it seems that Share permissions take over. How is it? It
>>>> should be that NTFS permission take over not oposit. Most restrictiv is
>>>> it not like that?
>>>>
>>>> /Marcus
>>>>
>>>> AllenM wrote:
>>>>> You really need to be more specific and provide more details such as
>>>>> the folder structure and most importantly the NTFS permissions on the
>>>>> parent folder as well as the sub folder. Are you sure there are no
>>>>> duplicate memberships for both Managers/Staff?
>>>>>
>>>>>
>>>>> "MarcusB" <marcusb@llunet.se> wrote in message
>>>>> news:uMFox3rrIHA.4492@TK2MSFTNGP02.phx.gbl...
>>>>>> We got very strange right problems on our server.
>>>>>> We have Common shares and we have enabled all rights for everyone on
>>>>>> the the share. Than we are giving proper security rights to groups.
>>>>>> Managers groups have write and read rights but Staff group have only
>>>>>> read rights.
>>>>>> When the staff login than can also write to the share. Why? What
>>>>>> happen?
>>>>>>
>>>>>>
>>>>>> Marcus
>
>