Home Folder Permissions

[Essam]

My File and Print server is MS Windows 2000 Server. When
creating a home folder for a user, the default permissions
to that folder is the owner full control and
administrators full control.

I used to work with WinNT and Win2000 Advanced Server
where the default permissions are full control for the
owner only and administrators have no access. This is the
logic approach and is more secure.

Is this by design and is a difference between Win2000 Sr
and Win2000 adv srv or do I have something wrong with my
server.

Appreciating help.

Regards,
Essam

 

[Guest]

Having the Administrator as full control to the folder is logical to me since the Administrator account is the account in charge of everything on that machine. If you wanted the folder re-sized or moved etc, only the Administrator could do that (if the user that also has the share full access doesnt have full Admin access)

Think of it like this - Admin = The god of accounts - accesses all. Without this, you are up the shoot!

 

[Essam]

Home folder by definition should be accessed only by the
owner. If for what ever reason the folder needs to be
administered then the administrator can take ownership of
the folder according to a company policy and realted
procedures.

what you are saying is that all data whether confidential
or not, should be accessed by the administrator. Any
organization does not have any option but to trust the
administrator?! which i see not logic and not practical.

Thanks any way,
Essam

-----Original Message-----
Having the Administrator as full control to the folder is

logical to me since the Administrator account is the
account in charge of everything on that machine. If you
wanted the folder re-sized or moved etc, only the
Administrator could do that (if the user that also has the
share full access doesnt have full Admin access)

Think of it like this - Admin = The god of accounts -

accesses all. Without this, you are up the shoot!

 

[Guest]

Yes I do think the Administrator should have access to all folders on the computer they administer, after all, without the Administrator, the folder wouldnt be there to start off with
Thats why companies only allow a limited amount of Server Administrators to do that task and sign a very strict security form.