Folder permissions

[jbisset]

We run a mixture of Win2k and Win2003 servers, with 2 legacy NT
systems. As a result, we have to tun Win2003 in "mixed mode". I know
one of the constraints of doing this is that you can't nest security
groups.

I have problems using security groups defined in Active Directory to
assign permissions to shares and/or folders. The permissions don't
appear to be applied correctly and I have to assign these directly to
the users. Is this related to running in mixed mode?

James.

 

[Steve Riley [MSFT]]

The only reason you'd need to remain in mixed mode is if you have to maintain NT 4 backup domain controllers. If all your DCs are Windows 2000 or Windows 2003, then you can move out of mixed mode.

--
Steve Riley
(e-mail address removed)
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com


We run a mixture of Win2k and Win2003 servers, with 2 legacy NT
systems. As a result, we have to tun Win2003 in "mixed mode". I know
one of the constraints of doing this is that you can't nest security
groups.

I have problems using security groups defined in Active Directory to
assign permissions to shares and/or folders. The permissions don't
appear to be applied correctly and I have to assign these directly to
the users. Is this related to running in mixed mode?

James.

 

[James Bisset]

I'm certainly prepared to go for that. Is it likely to explain the
problem with security group permissions not being applied?

James.

 

[Roger Abell [MVP]]

I'm certainly prepared to go for that. Is it likely to explain the
problem with security group permissions not being applied?

Perhaps it does, but as I read your post, no, it does not.
What is your setting for Pre-Windows 2000 compatibility?
You should have been able to use the domain global groups
on the NT4 or other members, which it seems you cannot.
However, Steve is quite correct and you would be better
positioned overall by getting at least to W2k mode (given
that your remaining NT4 are only non-DC members).