Special Permissions!!

[Paul Cachia]

Can anybody explain to me what the difference is between the NTFS Special
permission "Change Permissions" and the "Take Ownership Permission", since
autmatically by granting the Change Permission you are going to allow the
user to Take Ownerhsip once he gives himself full control. And how come the
MCSA books state that you can allow an admin to change permissions but not
be able to delete files or folders!! He will manage just gives himself full
control and does what he likes to the folder and subfolders. Even if you
deny him, he can remove the denied permissions at least I managed when
testing the functionality of the two special permissions.

Thanks Help I'm really frustrated about this!

 

[Joe Richards [MVP]]

If you grant someone the ability to change permissions they can do whatever they want period as you are giving them the
ability to overwrite the sd with whatever they want.

If you grant someone the ability to take ownership they can also do whatever they want period because they can take
ownership of the object and by default and HARDCODED into NTFS, the c/o has FC over the object.