A complete rewrite of my previous question, in a different context.

Basically, the issue is that when I create a new user within a new group, the new user has various permissions over various folders.

I have deleted the group "users" from this user object, and it is simply a member of the group "test".

I have created a folder called c:\foo, when I go to effective permissions under the security tab, I can see that the user "lockdown" has various permissions.

alt text

As far as I can see, there is nothing that should allow lockdown access.

alt text

The moment I remove users from this list, it behaves as I would expect, which makes me believe that for some strange reason, the users group behaves like the everyone group and is controlled by the system. That being said, I cannot understand this as under the list, it is not there - and further to this, with the same permissions as the first picture, guest does not have access.

This has stumped me and any help is appreciated!

(Tested in Windows 2003 and 2008)

edit - Should also say that if I go to Effective Permission for the group the user is in, there are no boxes checked, so it is somehow just the user that is getting the permissions from somewhere.

| |
  • if FitzRoy's answer is sufficient, please mark it so for reference of those looking to assist. – Zayne S Halsall Nov 20 '10 at 9:59
  • So I notice that the "Users" group has two entries: one with Read & execute, the other with Special. Does the lockdown account retain permissions when both of the "Users" entries in the security tab are removed. Could you also include a screenshot of the members of the "Users" group? That may show us what is going on. – Doltknuckle Sep 15 '11 at 18:31
  • @Doltknuckle - I never came up with a (good) solution all the time on... but, I did a workaround the machines are in production / I can't easily test... I have a virtual backup machine of the server and will try to test it - but, it may not be for a few weeks as I have stacks of work on at the moment. – William Hilsum Sep 15 '11 at 19:05

The folder you have created will have inherrited its permissions from the root folder. If for example you have created the folder straight off of C:\ the 'Users' group will probably have at least Read & Execute, List Folder Contents, Read, and possibly some additional Special Permissions.

Although your user account isnt directly a member of the 'Users' group, the 'Authenticated Users' and 'INTERACTIVE' groups ARE members of the Users group. Any user that authenticates to your computer becomes a member of the special 'Authenticated users' group and thus the 'Users' group permissions are applicable to that user.

Therefore removing the 'Users' group permissions from the folder should solve your problem.

| |
  • Thank you, I am still confused as to why guest has no effective permissions though :S – William Hilsum Sep 10 '09 at 22:53
  • 6
    Authenticated Users does not include the Guest account, therefore if you are checking effective permissions for Guest whilst logged-in using another account it shouldnt have any permissions. However if you logged-in to the machine as Guest you may well find you have permisions becuase that account would then become a member of the 'Interactive' group because you have started an interactive logon session. – FitzRoy Sep 10 '09 at 23:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.