User/Group perm issues

[segment]

Greets all. I'm coming from a *nix environment so excuse my lack of Windows tolerance and overall usage. Anyway, I'm managing a Win2003 SBS server and am having an issue with group permissions.

I've created a group called Somedepartment with three users. John, Jane, and Mary. These users happen to also be in the group Users.

I have a folder that only Somedepartment is allowed to access called SDOnly. I've assigned the permissions in sharing and security to the Somedepartment group.

Simply explained?

John and Jane can access files this way just fine in the SDOnly folder, but Mary cannot. If I give rights to Users to access the SDOnly folder, then all three have no problems. Am I missing something?

 

[Catadmin]

Mary is inheiriting permissions from some other group or GPO that has a deny access on it. Verify what groups she is a member on by going to the Member Of tab of her user object. Then verify the permissions of each group.



Catadmin - MCDBA, MCSA
Beware the error of pre-emptive poultry inventory!

 

[segment]

By the way for kicks and giggles I added the group to become a member of the administrators group just now. So here goes...


SomeDepartment group (member of administrators group)
John
Jane
Mary

Users group
John
Jane
Mary

SDOnly (folder)
permissions for sharing and security are set to the SomeDepartment group.

When SDOnly does NOT have the Users group in the permissions, only two people can access the files in the SDOnly folder. When I add the Users group all three can access files.

I only want John Jane and Mary to be able to access the folder. Take note the Users group actually has +40 people in it. Meaning I only want John, Jane, and Mary to access these files. Apparently creating a group for them and them alone doesn't seem to work.

Oh how I wish I could just chgrp $FOO $FILES it seems so much easier.

 

[Catadmin]

Forget about adding new groups for these three users. Go back to Mary and back track every group she is a member of and every GPO that is attached to her and the groups she is a member of. Windows uses a "Most restrictive permissions apply" type of mentality. If there's a deny somewhere in there for one of the GPOs or groups, that's were she's losing her ability to connect.

It could also be as simple as a deny permission to connect to the computer in question or a deny permission on the network share right above the share you gave her permissions on.



Catadmin - MCDBA, MCSA
Beware the error of pre-emptive poultry inventory!

 

[moorethan]

you probably got the wrong mary.