1

This may be a naïve question, but I'm concerned about file ownership and group access under NTFS file systems and in a Windows AD environment.

Let's say that Jim-Bob created a folder, \stuff, and put a text document, \stuff\words.txt, in that folder under the share \\totally-hipaa-compliant-server\ultrasecure. He had the appropriate permission to do so because he's a part of the Super Trusted Users group, which is required for access to the ultrasecure share.

Jim-Bob then causes an incident and gets himself removed from the Super Trusted Users group. Does removing him from the group remove his ownership of the folder and file? If he has ownership of the file and folder, can he still access that file and folder despite having no permission to the ultrasecure share?

I realize this sounds a little academic, but I'm listing file permissions on a share and seeing old users as owners, and the users seem to have ownership permissions. I'm not sure if this is cause for concern.

3

Removing him from the group does not remove him as the owner of the file. However, it does remove his ability to get to the file.

NTFS file/folder ownership grants the owner to add/change/remove permissions of a file or folder. However, if the user can not access that file, it is a moot point.

It would probably be a good idea to change the owner of the file to someone else in that group though. You never know where you might have made a share/permissions error and that person still has access to the file.

| improve this answer | |
  • Looks like ownership isn't a problem, thanks. Turns out explicitly adding a single user permission to a subfolder can be... Guess I get to scan all the subfolders anyway. – rtf Oct 8 '13 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.