Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created FolderA and set permission for Administrator, Creator Owner, SYSTEM and UserA. I even uncheck the Allow inheritance Permission

UserA should have access to FolderA

UserA can access FolderA as he should.

But when I log in with another User, I can still access the FolderA.

However, when I remove the Administrator, and retain the 3 users (Creator Owner, SYSTEM and UserA) in the folder permissions, UserA cannot access FolderA.

Why is that? Can you help me identifying the problem?

Do I need to create a group policy for this?

share|improve this question
You do indeed need to create a group policy. It would actually be easier to create a group that can access it and just place UserA in that group. – Ramhound Apr 10 '13 at 11:02

I think there is some confusion between Security Groups and Group Policy. Security Groups are used to set security boundaries which in turn are used to determine access and control. In the case of files and folders, placing UserA in SecurityGroupA then granting SecurityGroupA NTFS/Share Permissions effectively gives those permissions to all members within the security group.

Group Policy is generally used to grant other rights and permissions to objects within Active Directory (Logon Locally, RAS Enabled, Shutdown, Restart and many hundreds of other non-filesystem related actions.

One of the things commonly missed when changing NTFS/Share permissions is that a user will almost always have to log off then log back on when you add/remove them from a security group to reflect changes in their security token.

How Access Tokens Work -

Understanding User and Group Accounts -

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .