folder access

[Guest]

I have a newly built Windows 2000 Server. A folder is copied on the root of the E:\ drive. So now there is a E:\ConveyData folder created. After this the ConveyData folder is shared as ConveyData and share level permissions with Change rights are given to 2 NT groups. Let's say GroupA and GroupB. These are the only groups on the share level permissions, the everyone group is taken out. After that, the same groups (GroupA, GroupB) are given NTFS level permissions as well with Change rights as well on the E:\ConveyData folder. There are other groups listed on the NTFS permissions on the E:\ConveyData folder but non are Deny access or at least they have read permissions.

Now, a user that I know is part of the at least GroupB tries to connect to the share \\server\ConveyData and can map a drive to the share but gets access denied. Why is that? GroupB has change rights on both Share and NTFS levels. Effective rights for the group (GroupB) on the ConveyData folder are correct "Change".
If I place his ID only on the share and NTFS he works. Also if I place the everyone group with read on either Share or NTFS and take out his user id he works as well.

 

[Pegasus]

I have a newly built Windows 2000 Server. A folder is copied on the

root of the E:\ drive. So now there is a E:\ConveyData folder created.
After this the ConveyData folder is shared as ConveyData and share level
permissions with Change rights are given to 2 NT groups. Let's say GroupA
and GroupB. These are the only groups on the share level permissions, the
everyone group is taken out. After that, the same groups (GroupA, GroupB)
are given NTFS level permissions as well with Change rights as well on the
E:\ConveyData folder. There are other groups listed on the NTFS permissions
on the E:\ConveyData folder but non are Deny access or at least they have
read permissions.

Now, a user that I know is part of the at least GroupB tries to connect

to the share \\server\ConveyData and can map a drive to the share but gets
access denied. Why is that? GroupB has change rights on both Share and NTFS
levels. Effective rights for the group (GroupB) on the ConveyData folder
are correct "Change".

If I place his ID only on the share and NTFS he works. Also if I place

the everyone group with read on either Share or NTFS and take out his user
id he works as well.
Since NTFS permissions are far more powerful than share permissions, I
recommend that you set the share permissions to "Full" for everybody, then
apply your restrictions by means of NTFS permissions.