Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I created FolderA and set permission for Administrator, Creator Owner, SYSTEM and UserA. I even uncheck the Allow inheritance Permission

UserA should have access to FolderA

UserA can access FolderA as he should.

But when I log in with another User, I can still access the FolderA.

However, when I remove the Administrator, and retain the 3 users (Creator Owner, SYSTEM and UserA) in the folder permissions, UserA cannot access FolderA.

Why is that? Can you help me identifying the problem?

Do I need to create a group policy for this?

share|improve this question
    
You do indeed need to create a group policy. It would actually be easier to create a group that can access it and just place UserA in that group. –  Ramhound Apr 10 '13 at 11:02
add comment

1 Answer

I think there is some confusion between Security Groups and Group Policy. Security Groups are used to set security boundaries which in turn are used to determine access and control. In the case of files and folders, placing UserA in SecurityGroupA then granting SecurityGroupA NTFS/Share Permissions effectively gives those permissions to all members within the security group.

Group Policy is generally used to grant other rights and permissions to objects within Active Directory (Logon Locally, RAS Enabled, Shutdown, Restart and many hundreds of other non-filesystem related actions.

One of the things commonly missed when changing NTFS/Share permissions is that a user will almost always have to log off then log back on when you add/remove them from a security group to reflect changes in their security token.

How Access Tokens Work - http://technet.microsoft.com/en-us/library/cc783557(v=WS.10).aspx

Understanding User and Group Accounts - http://technet.microsoft.com/en-us/library/bb726978.aspx

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.