Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to set up a file server on my my Windows 7 Pro system at home. I set up one common "Share" folder that I have shared/published. Within the share folder I want to have individual folders for me and my wife...that is only I can read/write my folder and only my wife can read/write to her folder and neither of us can read the contents of the other person's folder. Then I want to have a "public" folder where we can both read/write to contents of the folder as well as any sub-folders created, but my "kids" account can only read from this folder and sub folders. It seems really confusing to set up something like this and it really shouldn't. I am really confused between the "allow", "deny", and dimmed check boxes in the security tab.

It seems that if I "Deny" access to "Everyone" on my private folder, then I don't even have access to it. Windows security seems backwards from the rest of the world's security models. If I am in two groups and I deny access to one of the groups but allow access to the other group then Windows security denies me access as I am in one of the groups that has access disallowed. Very confusing.

share|improve this question

2 Answers 2

up vote 5 down vote accepted

I agree, the security tab is certainly confusing.

I think the key thing to understand is you can Deny a privilege to "everyone else" without explicitly checking the Deny box. "Deny" takes precedence over allow, so denying everyone will mean no-one has that privilege, even those you to whom you explicitly grant it.

I think you want this set up;

Your folder

  • Everyone: Uncheck all boxes
  • Your user: Check "Full control"
  • Remove any other user

Your wife's folder

  • Everyone: Uncheck all boxes
  • Your wife's user: Check "Full control"
  • Remove any other user

Shared folder

  • Everyone: Uncheck all boxes
  • Your "kids" user: Check "read"*
  • Your user: Check "Full control"
  • Your wife's user: Check "Full control"
  • Remove any other user

Child folders will inherit their permissions from their parents.

*Here you could optionally deny write, but as the kids user and the everyone user does not have a "check" for write, the user does not get that permission. If you wanted "everyone" to write, but not kids, this is where you would use Deny.

share|improve this answer
    
I think the cause of a lot of my problems was the child folders inheriting permissions from the parent. Once I modified so as not to inherit permissions, I got everything to work fine. –  GregH Apr 12 '10 at 14:08

Deny permissions take precedence over Allow permissions. Instead of adding a Deny permission for Everyone, take away the relevant Allow permissions which might be giving access to the wrong accounts. You might have to uncheck "Inherit from parent the permission entries that apply to child objects. Include these with entries explicitly defined here", then make sure there are Allow permissions which give you access.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.