0

There is this directoy inside a shared resource that's accessible to everyone and I have to secure it so only one user can have access to it, so I proceeded to create their account and then set the rights on the directory, and by default it has 6 different rights profiles:

  1. Everyone
  2. Users
  3. Administrator
  4. Administrators
  5. CREATOR OWNER
  6. SYSTEM

So I would only need to add the new user's account to the security profiles and revoke access to the Everyone and Users groups, right? the problem is that this new account is also a member of the Users group, and obviously from the Everyone group too, and if I revoke access to those two groups I lose access from the new user's account too, not to mention I also lose access with the Adminitrator account (but I can still edit the right's settings even though windows tells me I can't).

How can I go about this?

1 Answer 1

0

First of all adding a user to the NTFS right is possible but its not recomended because if you have a lot of singe users on a file/folder it will take a hell lot of time for the system to determine the rights. In a small network it may not be an issue but its a bad thing to do anyways.

You allways create a group for a file or ressource e.g Group "Fldr_NewFolder" and set this group on the NTFS rights. Remove all users or groups you dont want to have the rights to use this folder. Do not create unessasary deny users/group entrys, if you remove the group it wont have access to the folder.

(Either you work here with the whitelist or blacklist method. Whitelist just add users you want to have access to this folder and remove alle other users from the security tab. Blacklist allow the ALL USERS group the access to the folder and then add all groups with DENY rights you dont want give permission to this folder. I would allways prefer the whitelist method.)

Now you could go to the user and add the user to the group "Fldr_NewFolder". But this is still not recomendet by microsoft. Usually you have one more group "User_GroupA" and this group you want to add as a member of group "Fldr_NewFolder".

You should read up on Microsofts best practice on file / shares management.

http://community.spiceworks.com/how_to/show/27258-best-practice-security-windows-file-sharing

These are specific to Windows 2008 -

Managing Permissions for Shared Folders http://technet.microsoft.com/en-us/library/cc753731.aspx

Share and NTFS Permissions on a File Server http://technet.microsoft.com/en-us/library/cc754178.aspx

======

These will also apply to Windows 2008-

Best Practices for Securing Files with NTFS Permissions http://technet.microsoft.com/en-us/library/cc782737(v=ws.10).aspx

Share permissions http://technet.microsoft.com/en-us/library/cc784499(v=ws.10).aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .