Assigning permissions to users

[Greg de Bruin]

I am from the Netware world and new to Windows Server.

I have set up an Active Directory and added Users and Groups. I would like
to assign folder permissions to various groups. Here is an example of what
I want to do:

Root directory is G:. Only Domain Admins have right to add or delete
folders at this level.

Below that is Administration. Let everyone see that folder but only members
of grpFinance can see it.

Below that is Finance2006. No one but Domain Admins and grpFinance can see
the folder. grpFinance can do whatever they want at this level.

Also below Administration is a folder called Forms. All Domain Users can
see this folder, can't delete it, can add or edit files to it, but can't
delete files in it.

Can anyone give me the permission assignments I would use to set up all of
the above?

Thanks,

Greg

 

[Kurt]

I am from the Netware world and new to Windows Server.

I have set up an Active Directory and added Users and Groups. I would like
to assign folder permissions to various groups. Here is an example of what
I want to do:

Root directory is G:. Only Domain Admins have right to add or delete
folders at this level.

Below that is Administration. Let everyone see that folder but only members
of grpFinance can see it.

Below that is Finance2006. No one but Domain Admins and grpFinance can see
the folder. grpFinance can do whatever they want at this level.

Also below Administration is a folder called Forms. All Domain Users can
see this folder, can't delete it, can add or edit files to it, but can't
delete files in it.

Can anyone give me the permission assignments I would use to set up all of
the above?

Thanks,

Greg

First of all, unlike Netware, all users can always "see" shares if the
browsing service is enabled, they just can't access them if permissions
deny them.

Secondly, managing with share permissions is not done as much because
NTFS allows permissions to be applied at the filesystem level, ala
Unix/Linux. This is a greater level of security. In fact, in Windows
2000 the default share permission level was "Everyone - Full Control".
Many (most?) W2K3 admins still set them that way and manage all
permissions at the filesystem level (from the "Security" tab).

Assuming file-level permissions, to do what you want, assign permissions
to users/groups directly on the G: Drive - That is if the G: drive is a
physical drive. If it is a mapped drive, assign the appropriate
permissions on the shared directory. You'll remove most of the default
security principals, like "Users", "Everyone", etc. Don't delete system
things like "System", "Owner", etc, and of course, don't delete
administrators. Once you've done that, those permissions will be
inherited by the subdirectories.

GO to the lower level directories and adjust permissions there to allow
other groups more permissions. You'll need to hit the "Advanced" button
and un-check the box that says "allow permissions to be inherited from
parent" or whatever. Then you can assign permissions as you see fit.

Also, there are a bunch of special permissions. For instance, you can
deny the "delete" permission there.

You need to get a book on AD. You really need to understand security
principals, the different types/scope of groups (local, global,
universal). You need to know how and where to apply ACLs and to what
they can be applied. And you need to understand OUs, group policy and
how those policies can make your life easier. There's NOTHING like
Active Directory. Not Unix/Linux. Not Netware. It's depth and central
management ablilties are one of a kind. Once you get used to it to where
it becomes a tool rather than an obstacle you'll agree.

....kurt

 

[Greg de Bruin]

Kurt,

Thanks for the tutorial. I'll take your advice and pick up a book on Active
Directory. Your enthusiasm for AD is inspiring.

Greg

 

[Ace Fekay [MVP]]

In

Secondly, managing with share permissions is not done as much because
NTFS allows permissions to be applied at the filesystem level, ala
Unix/Linux. This is a greater level of security. In fact, in Windows
2000 the default share permission level was "Everyone - Full Control".
Many (most?) W2K3 admins still set them that way and manage all
permissions at the filesystem level (from the "Security" tab).

Kurt, excellent post. I just want to point out to Greg how share permissions
and NTFS (security tab) permissions work together.


Greg,

The share permission is what allows the intial connection. Once allowed in,
then the NTFS permissions are evaluated. The resulting permission is a
combination of all the permissions for any specific security principle
(group, user or even computer account). It is easier to explain that the
security principle gets the most restrictive permission of the two as the
resultant permissions to access the reource.

For example, let use an account called John Smith.

John has Full Control on the Share permissions fo the Sales folder.
John has Modify on the NTFS permissions of the Sales folder.
John's resultant permission is Modify (not full control) because it is the
most restrictive.

Now if John is part of a group that has more permissions than his account,
then the least restritive applies between multiple entries that a security
principle is a member of.

So now let's add John to the Sales group.

John has Change Share permissions on the Sales folder.
The Sales group has Full Control Sahre permissions on the Sales folder.
John has Read NTFS permissions on the Sales folder.
The Sales group has Modify NTFS permissions on the Sales folder
The resultant permission will be Modify.

Inheritance is automatic going downhill as Kurt already explained and
controlled by not allowing inheritance. Child can override the parent
permissions. However if the parent share is Read, and the child is FC, the
resultant will be Read.

Then there's group nesting. Keeping track of who's who in a nested scenario
is easy as long as you follow the rules and guidelines in using them. Domain
mode is also a factor in what nesting options are available.

I would take up Kurt's suggestions to read up on AD, or better yet, attend a
Microsoft Official Curriculum (MOC) course on AD. The course is a 5 day
hands on with labs instructore lead class. You will be amazed at what you
will learn in the course.GPOs, installing and removing DCs, Sites, Recovery,
and much more. Below is a link with more info on the class.

2279: Planning, Implementing, and Maintaining a Microsoft® Windows ServerT
2003 Active Directory® Infrastructure
Summary: In this five-day instructor-led course students will learn the job
skills necessary to plan, implement and troubleshoot the key components of a
Microsoft Windows Server 2003 directory service environment.
Audience: IT professionals
Delivery Method: Instructor-led (classroom)
http://www.microsoft.com/learning/syllabi/2279Afinal.asp

Good luck with everything.

--
Ace
Innovative IT Concepts, Inc (IITCI)
Willow Grove, PA

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Directory Services
Microsoft Certified Trainer

Having difficulty reading or finding responses to your post?
Instead of the website you're using, I suggest to use OEx (Outlook Express
or any other newsreader), and configure a news account, pointing to
news.microsoft.com. This is a direct link to the Microsoft Public
Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows you
to easily find, track threads, cross-post, sort by date, poster's name,
watched threads or subject.
It's easy:

How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Infinite Diversities in Infinite Combinations
Assimilation Imminent. Resistance is Futile
"Very funny Scotty. Now, beam down my clothes."

The only constant in life is change...

 

[Ace Fekay [MVP]]

In

I am from the Netware world and new to Windows Server.

I have set up an Active Directory and added Users and Groups. I
would like to assign folder permissions to various groups. Here is
an example of what I want to do:

Root directory is G:. Only Domain Admins have right to add or delete
folders at this level.

Below that is Administration. Let everyone see that folder but only
members of grpFinance can see it.

Below that is Finance2006. No one but Domain Admins and grpFinance
can see the folder. grpFinance can do whatever they want at this
level.
Also below Administration is a folder called Forms. All Domain Users
can see this folder, can't delete it, can add or edit files to it,
but can't delete files in it.

Can anyone give me the permission assignments I would use to set up
all of the above?

Thanks,

Greg

Try this:

In your scenario, I would suggest to not use the volume root, but rather
create a subfolder called Administration. We'll make this our security area
to control for access. Unlike Netware, the volume root is already shared FC
access only to Domain and Local Admins, as well as System, etc. Let's leave
that be.

Therefore let's try this based on what you posted (I thought this through
within a minute or so, so pardon any errors):

G:\Administration
Share as "Administration"
Share permissions:
Remove Everyone
Domain Admins FC
Authenticated Users: C

NTFS persmissions:
Remove Everyone
Authenticated Users: R
Finance Group: M


G:\Administration\Finance2006
NTFS Permissions:
Remove Inheritance
Remove Everyone
Remove Auth Users
Domain Admins: FC
Finance Group: M


G:\Administration\Forms
NTFS Permissions:
Remove Inheritance
Remove Everyone
Domain Admins: FC
Authenticated Users: R

Notice no user accounts have FC. Also notice I use Authenticated Users and
NOT the Everyone group, since it comprises more than just Auth Users. Domain
Users and Authenticated Users are close in description, however I would like
to look at Authenticated Users as someone that has already logged in
successfully.

I would then document it with enough detail so my 10 year old can easily
read it and re-apply permissions if they needed to reconstruct it. (Well,
almost.)

Please also read my reply to Kurt, which was more meant for you. but I had
already written and sent it prematurely and meant to put most of it here.


--
Ace
Innovative IT Concepts, Inc (IITCI)
Willow Grove, PA

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Directory Services
Microsoft Certified Trainer

Having difficulty reading or finding responses to your post?
Instead of the website you're using, I suggest to use OEx (Outlook Express
or any other newsreader), and configure a news account, pointing to
news.microsoft.com. This is a direct link to the Microsoft Public
Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows you
to easily find, track threads, cross-post, sort by date, poster's name,
watched threads or subject.
It's easy:

How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Infinite Diversities in Infinite Combinations
Assimilation Imminent. Resistance is Futile
"Very funny Scotty. Now, beam down my clothes."

The only constant in life is change...

 

[Ryan Hanisco]

Greg,

In addition to everyone's great advice, remember that you cannot use an
OU as a security principal by which to assign permissions to objects in
the file system.

In Windows, you must make a group and use that instead. It isn't a
major difference, but if you are trying to make a direct translation
between rights, you will want to watch that as it can catch you.

Ryan Hanisco
FlagShip Integration Services