USERS group and NTFS permissions

[Guest]

1. First I create new user TEST. (By default he is a member of USERS group)
2. Next I create folder ABC and set permissions as follows:
- ADMINISTRATORS - ALLOW - FULL CONTROL
- USERS - DENY - FULL CONTROL
3. Next I remove users TEST form the group USERS.
4. Next I log in as TEST and try to access folder ABC - which is ACCESS
DENIED.
5. Now user TEST is only a member of Administrators group (FULL CONTROL
ALLOW).
The question is: why TEST has no access to folder ABC ?

 

[Lanwench [MVP - Exchange]]

In

1. First I create new user TEST. (By default he is a member of USERS
group)
2. Next I create folder ABC and set permissions as follows:
- ADMINISTRATORS - ALLOW - FULL CONTROL
- USERS - DENY - FULL CONTROL
3. Next I remove users TEST form the group USERS.
4. Next I log in as TEST and try to access folder ABC - which is
ACCESS DENIED.
5. Now user TEST is only a member of Administrators group (FULL
CONTROL ALLOW).
The question is: why TEST has no access to folder ABC ?

These are all local users/groups, right? Not domain users / groups?

I'm not 100% sure about this, but if you mean the built-in "users" group, I
don't think you can actually remove anyone from it. And a 'deny' always
trumps an 'allow' from another group.

I would set up custom groups for your security. You likely don't need
"deny" on anything, anyway - just don't add that group to the 'allowed' list
at all.

Someone may correct me; it's happened before.