F&F permissions - Deny?

[Lemon Jelly]

Am using XP Pro. Whilst experimenting with file & folder permissions &
using the Deny option for the Users group, it appears to override even
permissions set for Administrators. This seems a pretty pointless option
so what am I missing here?

 

[Ron Bernier]

I believe, even though it does not list in when you "manage" 'My Computer',
the user "Administrator" is a part of the "Users" "group" ... You would need
to define a group for Deny rights that did not have the Administrator in it
(such as any user-created group) ...

 

[Lemon Jelly]

I was wondering if that was the case as permissions default to deny (& a
message box states this) when a user is a member of more than one group.
Can my own a/c with admin rights be removed from the Users group?

Have just tried adding a limited a/c rather than group to the list &
denying full control. The folder is now accessible from my a/c which
proves your statement.

Ron Bernier - typed:

 

[Roger Abell]

Deny always override any grants, no matter what account
is involved.
General rule is add together all grants, direct or indirect
via groups, then subtract all denies, direct or indirect.
The result is the allowed permissions.

Always attempt to devise a way to use only grants, before
resorting to using denies, and when using deny do not use
the built-in groups unless you are certain of the impact.
Deny is most often used with a custom group.

 

[Lemon Jelly]

Thanks for the clarification both of you. My usual strategy is to
restrict the Users group etc in partition roots then drill down to
folders or docs then allow access. My machine is basically only used by
me with a limited guest style a/c.

Paul