File Permission

[llam]

Can someone help me solving this?

Server running Windows 2000
A shared folder: \\machine\data
everyone has full control, change, read permission

I have organized the folders as this:
\\machine\data\group -> can only be accessed by that group
\\machine\data\shared -> can be accessed by everyone
\\machine\data\shared\protected -> non-group can read
group can read and write
\\machine\data\shared\public -> everyone can read and write

Now I have set the permission as the following:
\\machine\data -> everyone can read (this folder)
group can read and write (this folder, subfolders, and files)
\\machine\data\shared -> everyone can read (this folder)
\\machine\data\protected -> everyone can read (this folder, subfolders and files)
\\machine\data\public -> everyone can write and read (this folder, subfolers and files)

Am I doing it correctly?
With this setting, users in group has permission to modify or delete existing folders. How can I prevent it without using "deny" permission? I want it only applys to folders that I created. Any files and folders they created, they should have permission to make any changes.

Sorry that I could not present the problem any clearer =)
Thanks!

-- llam

 

[Catadmin]

Be patient with me. I'm studying for my Win2000 Svr Cert and am a little wobbly, but I'll try to help.

If I remember, in the permissions part of the policy, modify and delete are seperate from read, write, change permissions. I think you can either specifically deny those 2 permissions (deny modify and deny delete). If not, once you set up your group policies, simply choose the "No Override" option to prevent user permissions or local permissions from overriding your group policy permissions.

I think you have to create 2 seperate group policy objects to do all this, rather then set this up as folder permissions. But, again, I'm still studying, so I could be rememering wrong. @=)

Anyway, give the No Override a shot and let me know if that works.

Catadmin - New to Server Admin, but willing to learn... All help is appreciated.

 

[tom11011]

Is this for an exam or do you need real world solutions?

 

[llam]

Oh yeah, I need a real world solution for that.
Hmm... The network is actually running NT domain,
but the file server is running Windows 2000.
Group policy on NT domain does not seem to help.
Any solution?

--llam

 

[yizhar]

HI.

The best solution is to re-organize the folder structure.
Something more logical like:
\\machine\group -> can only be accessed by that group
\\machine\shared -> can be accessed by everyone
\\machine\protected -> non-group can read
\\machine\public -> everyone can read and write

All folders will be under a central DATA folder on the server itself, but you can share each folder by its own, and users will map 4 separate drives to each shared folder.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar