Permissions - Strange Change Permissions issue

[Greg Saunders]

Hello,

Got something strange unless I am not remembering correctly.

We have an older Windows 2000 web server.

User X has modify rights in a folder... let's call TestFolder.

He is not able to change permissions on this folder since he only has
modify rights.

User X should be able to create a new folder let's call TestSubFolder.

User X is now the owner of this folder, but I thought he should NOT be
able to set permissions on the folder TestSubFolder, but he can.

Is this correct? Am I remembering incorrectly? I thought he should NOT
be able to change permissions on the folder he created... because he
should NOT have change permissions rights?

Thanks in advance for your input.

Greg

 

[Greg Saunders]

Hello,

Got something strange unless I am not remembering correctly.

We have an older Windows 2000 web server.

User X has modify rights in a folder... let's call TestFolder.

He is not able to change permissions on this folder since he only has
modify rights.

User X should be able to create a new folder let's call TestSubFolder.

User X is now the owner of this folder, but I thought he should NOT be
able to set permissions on the folder TestSubFolder, but he can.

Is this correct? Am I remembering incorrectly? I thought he should NOT
be able to change permissions on the folder he created... because he
should NOT have change permissions rights?

Thanks in advance for your input.

Greg

Looks like I may be wrong on this... I found documentation showing he
could change permissions... this to me is a big worry because on the web
server he could set the incorrect permissions to anonymous accounts and
really put us in a bind from a security standpoing, but being he is
creating the website we have to allow him to create folders.

We have had this problem in the past and is the only reason we are
concerned.

Thanks again.

 

[Greg Saunders]

Looks like I may be wrong on this... I found documentation showing he
could change permissions... this to me is a big worry because on the web
server he could set the incorrect permissions to anonymous accounts and
really put us in a bind from a security standpoing, but being he is
creating the website we have to allow him to create folders.

We have had this problem in the past and is the only reason we are
concerned.

Thanks again.

Further info...

We had the share permissions for this user at full... changing it to
change / read solved the issue.

 

[Roger Abell [MVP]]

Further info...

We had the share permissions for this user at full... changing it to
change / read solved the issue.

For what it is worth . . .

Restricting with share level permissions mask (or filtered) your issue.
The behavior you observed is correct for W2k (or W2k3, XP, Vista),
and may arise in a couple ways: a grant to Creator Owner, or, use of
the rights of ownership. It sounds like you experienced the first, with
no need to use the available second of the two.
Should the user obtain an access not filtered through the share level
permissions, or should the share permissions be altered in error, etc.
then your issue shows that it remains an issue.

Roger