Share permission ACL's

[Guest]

I know that NTFS DACL's are "stored" as part of the folder or file, but where
are the share ACL's for a folder stored? I changed the share ACL's on a
folder, but the folder's write time did not seem to change, so where are the
permissions kept??

 

[Steven L Umbach]

I don't know exactly where they are stored offhand but I don't know why you
would expect the write time to change as either the user would have the
ability to write to the share or not. If your permissions do not seem to
work well then check the membership of the user account that you are using
because a user will end up having the most permissive permission to a share
based on his group membership unless one group/user has deny permission
which will cause a deny for the share. To prevent a user to write to a share
just give him "read" permission for the share or make sure he does not have
write ntfs permission to the folder via group membership or explicit user
account permissions. If you are changing a users group membership then be
sure to log user off and logon again to update his access token with new
group membership before testing access to a share.

 

[Roger Abell]

Share permissions are stored in the registry at
HKLM\System\CurrentControlSet\Services\Lanmanserver\Shares\Security

Oh, and BTW, NTFS Acls are really not stored as part of the file anymore,
thought that was true back at NT4 and earlier.