Re: permissions clash

Tech-Archive recommends: Speed Up your PC by fixing your registry

Off the top of my head, I can't think of anything WS03-related that can't be
used on SBS. You can download and install the access based enumeration
stuff, the resource kit, etc. In fact, I use the WS03 admin tools on my XP
box to manage the server remotely from my desk, and I use the support tools
on the server itself.

I don't find as much use for some of the tools as I might in a larger
network - I seem to have installed "Cluster Administrator" and "Network Load
Balancing Manager" on my desktop - but whatever you see a benefit from
should work fine.


"Jerome" <foo@xxxxxxx> wrote in message
news:OsYmjRztGHA.4968@xxxxxxxxxxxxxxxxxxxxxxx
Dave Nickason [SBS MVP] wrote:

"Deny" trumps "Allow" in NTFS permissions. Because the members of the
security group are also included in Users, a Deny applied to the Users
group overrides any higher access level set elsewhere for those users.

Here's what I would do: Just set the permissions you want for the
appropriate users or security group, and don't worry about the other
users, except to look in Advanced to make sure they are not inheriting
permissions
from somewhere else. Test to make sure they don't have access
accidentally when you're all finished.

If you don't want them to be able to see the folders' contents, check out
a
cool thing that came in WS03 SP1 called access-based enumeration. It
keeps users from seeing resources they don't have permission to access.
http://www.microsoft.com/windowsserver2003/techinfo/overview/abe.mspx

Thanks Dave!

We are using 2003 SBS SP1 here and there doesn't appear to be any
Access-Based Enumeration. Is this a WS03-only tool? I see I can download
it
but is it safe to install on SBS 2003? Can I use the WS03 Resource Kit
Tools too?

"Jerome" <foo@xxxxxxx> wrote in message
news:OcFeKKntGHA.2224@xxxxxxxxxxxxxxxxxxxxxxx

I have a share called "Admin", and a group called "Admin". I wish to
have
only people in the "Admin" group see and operate on this share, and all
other Users denied. However, when I check the Effective Permissions for
a
user in the Admin group it appears that the Deny rights of the User
group
override the Full Control rights of the Admin group.

How should I do this properly?

I am using the "Admin" name to refer to the company (not server)
designation - only the company owner and his assistant should have
access
to the share, and no one else should be able to read files in it.




.

Relevant Pages

  • Re: Strange Printer Issue...One Client cant access network printers
    ... Logged on as an admin, what happens if you add the Domain Users group (with ... Full Permissions) to the Security settings on the printer, ... network printers are shared and visible in the SBS2003SP1 network ... When I try to access printer Properties (as SBS ...
    (microsoft.public.windows.server.sbs)
  • Re: Strange Printer Issue...One Client cant access network printers
    ... Logged on as an admin, what happens if you add the Domain Users group (with ... Full Permissions) to the Security settings on the printer, ... network printers are shared and visible in the SBS2003SP1 network ... When I try to access printer Properties (as SBS ...
    (microsoft.public.windows.server.sbs)
  • Re: ERROR: Add PC to Domain Incomplete (SBS 2003)
    ... Forgot your Windows NT/2k/XP/Vista admin password ... I administer a domain through an SBS 2003 server. ... On the client PC, I changed the computer name and the domain, and then ... On reboot, I can't log on with the old domain's admin credentials, nor ...
    (microsoft.public.windows.server.sbs)
  • RE: Messages from ending up in badmail folder
    ... mail folder is all BCC mail. ... SBS 2003 - Admin ... What's worse is that the mail ending up in the badmail directory all are ...
    (microsoft.public.windows.server.sbs)
  • Re: XP Administration By domain admin
    ... All machines have the domain admin user in each machine's local ... administrator group. ... give each user admin rights over their own machine. ... Any event log errors on the SBS or that XP workstation? ...
    (microsoft.public.windows.server.sbs)