NTFS Permssions from an Novell NDS perspective

[iwebster]

Hi everyone,

I have just upgraded several servers to W2K3 and am migrating data from our Netware 4.11 server.

My question is releated to subfolder permissions.

As an example on the Netware box I could create a nest of subfolders, and give direct rights to a user or group at the very bottom level and as a result the user could navigate down throught the tree to the folder in question.

However with NTFS I cannot seem to be able to do this! I have created a share at the top level and I have blocked inheritance from there. I have set full permissions on the bottom subfolder in the tree for the user but that user cannot navigate down! Do I need to set permissions all the way down as well? Am I misunderstanding something?

Thanks

 

[mrtoledo]

If you block a Shared permission from a user, you would need to create a seperate share down the tree because if they can't access the share they can't see the data.

Generally we leave our shares farily open and use the NTFS rights to turn off rights from a directory.

Watch out if you are using any type of deny rights. Deny rights are exclusive over other rights. Lets say a user is a member of Groups A,b,c,d and the groups have the following rights

Group A Read
Group B Modify
Group C Deny
Group D List Contents

The user would be blocked out from anyting because they are a member of Group C.

NTFS permissions always combine for the most rights unless DENY is used.

Shared rights work the same way, for effective shared rights, but before access is granted the system looks at the combined shared and combined NTFS rights values and gives the most restrictive.

 

[iwebster]

Thanks! Finally got my head round all the permissions stuff!