Permissions Puzzle

[Jade]

This week, we were switching from a Netware server to a
Windows 2000 server. We created a folder called Data and
shared it (the group everyone, has full permissions on
the share tab) on the Windows 2000 server and into it, we
copied from the Netware server a folder called Images.
The Images folder contains multiple subfolders and jpg
files within the subfolders.

Two days after copying the Images folder over onto the
Windows 2000 server, we noticed that permissions hadn't
been set properly. That is, as it stood, "everyone" had
full control set on the Security tab to the Images folder-
-whoops!

On the Images folder, on the Security tab, we removed
the "everyone" group. We then added the HRS group and
gave them Full Control. We added the Administrator group
and gave them full control and finally, we added the HRS-
RO group and gave them Read, List Folder Contents, Read
and Execute Control.

Everything seemed to be working okay, except we've
discovered that any file that was created in the two-day
period (before we reset the permissions), only the HRS
group can access. The Administrator's group can't access
it and the HRS-RO group can't access it. However, all
groups seem to be able to access files correctly that
were copied over from the Netware server and files that
were created after we reset the permissions. As an
Administrator, if I check the properties on the folders
that hold the affected files, permissions appear correct
as they were reset, and the "Allow inheritable
permissions to propagate this object" is checked. If I
try to check the permissions on the affected files, I
receive the message that I don't have permission to view
or edit the current permission settings for this file.
If I add an administrator account to the HRS group and
then check the permissions on the affected files, the
only group that has any permissions set for this file, is
the HRS group.

I'm wondering why, when I reset the permissions, the
Administrator group and the HRS-RO group's permissions
didn't get carried down to these affected files. Like I
said, it's only the files that were created in the two
days before I reset the permissions that seem to be
affected. Also, I'm wondering how to correct this. Is
there a setting or command that I can run to re-propagate
the permissions down to all folders, subfolders and files
contained within my Images folder.

Any help would be appreciated as this affects
approximately 500 files located in various subfolders.

TIA.

 

[Michael Bednarek]

[edited: recently changed ACLs did not affect existing files]

I'm not on an NT system at the moment, but I think there's a button on
the Security tab -possibly in the Advanced dialogue- which will apply the
current settings to all objects below. Have you tried that?

Or you could use a command line tool, like CACLS or the like.

Three comments on your ACLs:
1. Don't grant anything on the network to Everyone, use Domain Users
instead.
2. Don't grant anything on the network to Administrator, use Domain
Admins instead.
3. Don't grant Full Control to anything on the network to anybody but
Domain Admins; grant R/W/C/D, but not Full Control.