Share and NTSF permissions...

February 13, 2008

Hi,

Did I say I can't stand Sharing and security on Windows?

Ooops, just did.

Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still makes

little sense, but I'm getting better.

What I need is a utility that would allow me to AUDIT my entire network and

show me all my USERS and GROUPS and what permissions they have, that would be

great!

Is there any such utility? (freeware would be nice!)

I'm aware of the "Effective Permissions" in the settings, but that is only

good for a single person/group.

I'd like to see a table of users and groups and then all the SHARE / NTSF

permissions and what overrides what.

Any ideas?

Thanks much,

Mark

(P.S, - why would NTFS permission to "view" not have precedence over Share

for viewing files or folders over the network? I'm still scratching my head!

=) )

February 14, 2008

RE: Share and NTSF permissions...

I believe AccessChk might help you out.

http://technet.microsoft.com/en-us/sysinternals/bb664922.aspx

--

Michael

"Mrpush" wrote:

> Hi,

>

> Did I say I can't stand Sharing and security on Windows?

>

> Ooops, just did.

>

> Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still makes

> little sense, but I'm getting better.

>

> What I need is a utility that would allow me to AUDIT my entire network and

> show me all my USERS and GROUPS and what permissions they have, that would be

> great!

>

> Is there any such utility? (freeware would be nice!)

>

> I'm aware of the "Effective Permissions" in the settings, but that is only

> good for a single person/group.

>

> I'd like to see a table of users and groups and then all the SHARE / NTSF

> permissions and what overrides what.

>

> Any ideas?

>

> Thanks much,

>

> Mark

>

> (P.S, - why would NTFS permission to "view" not have precedence over Share

> for viewing files or folders over the network? I'm still scratching my head!

> =) )

February 14, 2008

Re: Share and NTSF permissions...

Think of the Share permissions as being the lock on the door and the NTFS

permissions as being the lock on the filling cabinet.

The key to filling cabinet is useless if you can't get into the room.

The computer uses the Share permissions to decide whether the user can

access the Share from another computer at all and what permissions will be

through that Share. The folder and file NTFS permissions are effective for

both local and remote access and give fine grained control over what the

user can do to the content. Share permissions have no affect on local

access (asuming the user is refering to the folder using the DriveLetter:\

as opposed to \\ComputerName\ShareName syntax).

The permissions that a user has when accessing through the Share is the

minimum of the Share and NTFS permissions. Thus if a user has Full Control

via NTFS, they can do whatever they want when logged on locally. If the

Share permission is Read, then they can only read files from another

computer. If you like, the Share permission take precedence over the NTFS

permission, but ONLY when the user is accessing via the Share (e.g. from

another computer).

In many cases, it is useful set the Share Permissions to Everyone (or

Authenticated Users) Full Control and manage access control entirly using

the NTFS permissions only. This simplifies administration and

troubleshooting without really compromising file security.

Share permissions were (are?) useful for file systems that do not have built

in access control (e.g. FAT or FAT32). For systems like Windows 3.1, 95

etc. Share Permissions were the only way to control who could access files

remotely. With NTFS, in most situations, the Share permissions don't add

anything to file security (access control) that is not already provided by

the NTFS file system, thus the suggestion to set them Full Control for all

users and simplify your life.

A general rule in a domain, to simplify administration, is to NOT add user

accounts to NTFS (or Share) permissions and not create local groups, but to

always use domain groups whose name identifies the resource (share or

folder) and the granted permissions. That way you can tell who has access

to what by reading the group membership in conjunction with the name of the

group, entirely in AD Users and Computers. If you're interested I can post

(or send you) a set of rules re. group membership etc. that have been found

to be useful in this regard.

--

Bruce Sanderson

http://members.shaw.ca/bsanders

It is perfectly useless to know the right answer to the wrong question.

"Mrpush" <Mrpush@discussions.microsoft.com> wrote in message

news:3FA2E0D4-AD75-4BF0-A410-1E6CC06B0FA4@microsoft.com...

> Hi,

>

> Did I say I can't stand Sharing and security on Windows?

>

> Ooops, just did.

>

> Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still

> makes

> little sense, but I'm getting better.

>

> What I need is a utility that would allow me to AUDIT my entire network

> and

> show me all my USERS and GROUPS and what permissions they have, that would

> be

> great!

>

> Is there any such utility? (freeware would be nice!)

>

> I'm aware of the "Effective Permissions" in the settings, but that is

> only

> good for a single person/group.

>

> I'd like to see a table of users and groups and then all the SHARE / NTSF

> permissions and what overrides what.

>

> Any ideas?

>

> Thanks much,

>

> Mark

>

> (P.S, - why would NTFS permission to "view" not have precedence over Share

> for viewing files or folders over the network? I'm still scratching my

> head!

> =) )

February 14, 2008

RE: Share and NTSF permissions...

DumpACL.

--

NetAdmin <São Paulo, BR>

"Mrpush" wrote:

> Hi,

>

> Did I say I can't stand Sharing and security on Windows?

>

> Ooops, just did.

>

> Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still makes

> little sense, but I'm getting better.

>

> What I need is a utility that would allow me to AUDIT my entire network and

> show me all my USERS and GROUPS and what permissions they have, that would be

> great!

>

> Is there any such utility? (freeware would be nice!)

>

> I'm aware of the "Effective Permissions" in the settings, but that is only

> good for a single person/group.

>

> I'd like to see a table of users and groups and then all the SHARE / NTSF

> permissions and what overrides what.

>

> Any ideas?

>

> Thanks much,

>

> Mark

>

> (P.S, - why would NTFS permission to "view" not have precedence over Share

> for viewing files or folders over the network? I'm still scratching my head!

> =) )

February 14, 2008

RE: Share and NTSF permissions...

Great, thank you, I will check this out!

"Michael Russell" wrote:

> I believe AccessChk might help you out.

>

> http://technet.microsoft.com/en-us/sysinternals/bb664922.aspx

>

> --

> Michael

>

> "Mrpush" wrote:

>

> > Hi,

> >

> > Did I say I can't stand Sharing and security on Windows?

> >

> > Ooops, just did.

> >

> > Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still makes

> > little sense, but I'm getting better.

> >

> > What I need is a utility that would allow me to AUDIT my entire network and

> > show me all my USERS and GROUPS and what permissions they have, that would be

> > great!

> >

> > Is there any such utility? (freeware would be nice!)

> >

> > I'm aware of the "Effective Permissions" in the settings, but that is only

> > good for a single person/group.

> >

> > I'd like to see a table of users and groups and then all the SHARE / NTSF

> > permissions and what overrides what.

> >

> > Any ideas?

> >

> > Thanks much,

> >

> > Mark

> >

> > (P.S, - why would NTFS permission to "view" not have precedence over Share

> > for viewing files or folders over the network? I'm still scratching my head!

> > =) )

February 14, 2008

Re: Share and NTSF permissions...

Bruce,

Bravo! Finally a useful explanation on this! (I have read at least 5 and

they did not help me much)

The "locks" explanation was very helpful. Somehow I was thinking that NTFS

would give me "network access". Share is the door, NTFS is the file cabinet,

this is good!

I also was somehow under the impression that SHARE-EVERYONE-FULL would give

EVERYONE full access to files (edit, delete, etc). But now I see that

SHARE-EVERYONE-FULL gives NO permissions unless NTFS also has EVERYONE (or

the user in question) with some type of permission.

I would really like to see the set of rules you are talking about, that

would be great.

Do you use any tools to audit you entire networks share and NTFS permissions?

Thanks very much,

Mark

"Bruce Sanderson" wrote:

> Think of the Share permissions as being the lock on the door and the NTFS

> permissions as being the lock on the filling cabinet.

>

> The key to filling cabinet is useless if you can't get into the room.

>

> The computer uses the Share permissions to decide whether the user can

> access the Share from another computer at all and what permissions will be

> through that Share. The folder and file NTFS permissions are effective for

> both local and remote access and give fine grained control over what the

> user can do to the content. Share permissions have no affect on local

> access (asuming the user is refering to the folder using the DriveLetter:\

> as opposed to \\ComputerName\ShareName syntax).

>

> The permissions that a user has when accessing through the Share is the

> minimum of the Share and NTFS permissions. Thus if a user has Full Control

> via NTFS, they can do whatever they want when logged on locally. If the

> Share permission is Read, then they can only read files from another

> computer. If you like, the Share permission take precedence over the NTFS

> permission, but ONLY when the user is accessing via the Share (e.g. from

> another computer).

>

> In many cases, it is useful set the Share Permissions to Everyone (or

> Authenticated Users) Full Control and manage access control entirly using

> the NTFS permissions only. This simplifies administration and

> troubleshooting without really compromising file security.

>

> Share permissions were (are?) useful for file systems that do not have built

> in access control (e.g. FAT or FAT32). For systems like Windows 3.1, 95

> etc. Share Permissions were the only way to control who could access files

> remotely. With NTFS, in most situations, the Share permissions don't add

> anything to file security (access control) that is not already provided by

> the NTFS file system, thus the suggestion to set them Full Control for all

> users and simplify your life.

>

> A general rule in a domain, to simplify administration, is to NOT add user

> accounts to NTFS (or Share) permissions and not create local groups, but to

> always use domain groups whose name identifies the resource (share or

> folder) and the granted permissions. That way you can tell who has access

> to what by reading the group membership in conjunction with the name of the

> group, entirely in AD Users and Computers. If you're interested I can post

> (or send you) a set of rules re. group membership etc. that have been found

> to be useful in this regard.

>

> --

> Bruce Sanderson

> http://members.shaw.ca/bsanders

>

> It is perfectly useless to know the right answer to the wrong question.

>

> "Mrpush" <Mrpush@discussions.microsoft.com> wrote in message

> news:3FA2E0D4-AD75-4BF0-A410-1E6CC06B0FA4@microsoft.com...

> > Hi,

> >

> > Did I say I can't stand Sharing and security on Windows?

> >

> > Ooops, just did.

> >

> > Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still

> > makes

> > little sense, but I'm getting better.

> >

> > What I need is a utility that would allow me to AUDIT my entire network

> > and

> > show me all my USERS and GROUPS and what permissions they have, that would

> > be

> > great!

> >

> > Is there any such utility? (freeware would be nice!)

> >

> > I'm aware of the "Effective Permissions" in the settings, but that is

> > only

> > good for a single person/group.

> >

> > I'd like to see a table of users and groups and then all the SHARE / NTSF

> > permissions and what overrides what.

> >

> > Any ideas?

> >

> > Thanks much,

> >

> > Mark

> >

> > (P.S, - why would NTFS permission to "view" not have precedence over Share

> > for viewing files or folders over the network? I'm still scratching my

> > head!

> > =) )

>

February 14, 2008

RE: Share and NTSF permissions...

Thanks very much, I will check this out.

Mark

"net_admin" wrote:

> DumpACL.

>

> --

> NetAdmin <São Paulo, BR>

>

> "Mrpush" wrote:

>

> > Hi,

> >

> > Did I say I can't stand Sharing and security on Windows?

> >

> > Ooops, just did.

> >

> > Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still makes

> > little sense, but I'm getting better.

> >

> > What I need is a utility that would allow me to AUDIT my entire network and

> > show me all my USERS and GROUPS and what permissions they have, that would be

> > great!

> >

> > Is there any such utility? (freeware would be nice!)

> >

> > I'm aware of the "Effective Permissions" in the settings, but that is only

> > good for a single person/group.

> >

> > I'd like to see a table of users and groups and then all the SHARE / NTSF

> > permissions and what overrides what.

> >

> > Any ideas?

> >

> > Thanks much,

> >

> > Mark

> >

> > (P.S, - why would NTFS permission to "view" not have precedence over Share

> > for viewing files or folders over the network? I'm still scratching my head!

> > =) )

February 15, 2008

Re: Share and NTSF permissions...

I've put the "rules" onto my web site - see

http://members.shaw.ca/bsanders/WindowsGeneralWeb/GroupsAccountsPermissionsGPOsRules.htm.

Comments are welcome!

--

Bruce Sanderson

http://members.shaw.ca/bsanders

It is perfectly useless to know the right answer to the wrong question.

"Mrpush" <Mrpush@discussions.microsoft.com> wrote in message

news:B04A56E8-1234-4DBE-8F5B-04CB7AD6A1C6@microsoft.com...

> Bruce,

>

> Bravo! Finally a useful explanation on this! (I have read at least 5 and

> they did not help me much)

>

> The "locks" explanation was very helpful. Somehow I was thinking that

> NTFS

> would give me "network access". Share is the door, NTFS is the file

> cabinet,

> this is good!

>

> I also was somehow under the impression that SHARE-EVERYONE-FULL would

> give

> EVERYONE full access to files (edit, delete, etc). But now I see that

> SHARE-EVERYONE-FULL gives NO permissions unless NTFS also has EVERYONE (or

> the user in question) with some type of permission.

>

> I would really like to see the set of rules you are talking about, that

> would be great.

>

> Do you use any tools to audit you entire networks share and NTFS

> permissions?

>

> Thanks very much,

>

> Mark

>

> "Bruce Sanderson" wrote:

>

>> Think of the Share permissions as being the lock on the door and the NTFS

>> permissions as being the lock on the filling cabinet.

>>

>> The key to filling cabinet is useless if you can't get into the room.

>>

>> The computer uses the Share permissions to decide whether the user can

>> access the Share from another computer at all and what permissions will

>> be

>> through that Share. The folder and file NTFS permissions are effective

>> for

>> both local and remote access and give fine grained control over what the

>> user can do to the content. Share permissions have no affect on local

>> access (asuming the user is refering to the folder using the

>> DriveLetter:\

>> as opposed to \\ComputerName\ShareName syntax).

>>

>> The permissions that a user has when accessing through the Share is the

>> minimum of the Share and NTFS permissions. Thus if a user has Full

>> Control

>> via NTFS, they can do whatever they want when logged on locally. If the

>> Share permission is Read, then they can only read files from another

>> computer. If you like, the Share permission take precedence over the

>> NTFS

>> permission, but ONLY when the user is accessing via the Share (e.g. from

>> another computer).

>>

>> In many cases, it is useful set the Share Permissions to Everyone (or

>> Authenticated Users) Full Control and manage access control entirly using

>> the NTFS permissions only. This simplifies administration and

>> troubleshooting without really compromising file security.

>>

>> Share permissions were (are?) useful for file systems that do not have

>> built

>> in access control (e.g. FAT or FAT32). For systems like Windows 3.1, 95

>> etc. Share Permissions were the only way to control who could access

>> files

>> remotely. With NTFS, in most situations, the Share permissions don't add

>> anything to file security (access control) that is not already provided

>> by

>> the NTFS file system, thus the suggestion to set them Full Control for

>> all

>> users and simplify your life.

>>

>> A general rule in a domain, to simplify administration, is to NOT add

>> user

>> accounts to NTFS (or Share) permissions and not create local groups, but

>> to

>> always use domain groups whose name identifies the resource (share or

>> folder) and the granted permissions. That way you can tell who has

>> access

>> to what by reading the group membership in conjunction with the name of

>> the

>> group, entirely in AD Users and Computers. If you're interested I can

>> post

>> (or send you) a set of rules re. group membership etc. that have been

>> found

>> to be useful in this regard.

>>

>> --

>> Bruce Sanderson

>> http://members.shaw.ca/bsanders

>>

>> It is perfectly useless to know the right answer to the wrong question.

>>

>> "Mrpush" <Mrpush@discussions.microsoft.com> wrote in message

>> news:3FA2E0D4-AD75-4BF0-A410-1E6CC06B0FA4@microsoft.com...

>> > Hi,

>> >

>> > Did I say I can't stand Sharing and security on Windows?

>> >

>> > Ooops, just did.

>> >

>> > Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still

>> > makes

>> > little sense, but I'm getting better.

>> >

>> > What I need is a utility that would allow me to AUDIT my entire network

>> > and

>> > show me all my USERS and GROUPS and what permissions they have, that

>> > would

>> > be

>> > great!

>> >

>> > Is there any such utility? (freeware would be nice!)

>> >

>> > I'm aware of the "Effective Permissions" in the settings, but that is

>> > only

>> > good for a single person/group.

>> >

>> > I'd like to see a table of users and groups and then all the SHARE /

>> > NTSF

>> > permissions and what overrides what.

>> >

>> > Any ideas?

>> >

>> > Thanks much,

>> >

>> > Mark

>> >

>> > (P.S, - why would NTFS permission to "view" not have precedence over

>> > Share

>> > for viewing files or folders over the network? I'm still scratching my

>> > head!

>> > =) )

>>

February 15, 2008

Re: Share and NTSF permissions...

About tools for auditing NTFS permissions: I personally have not needed to

do this, but I understand that tools such as cacls, xcacls might be useful

for this.

For xcacls, see http://support.microsoft.com/kb/318754.

For large folder structures, these tools can generate a huge amount of

output if used recursively, so be prepared!

--

Bruce Sanderson

http://members.shaw.ca/bsanders

It is perfectly useless to know the right answer to the wrong question.

"Mrpush" <Mrpush@discussions.microsoft.com> wrote in message

news:B04A56E8-1234-4DBE-8F5B-04CB7AD6A1C6@microsoft.com...

> Bruce,

>

> Bravo! Finally a useful explanation on this! (I have read at least 5 and

> they did not help me much)

>

> The "locks" explanation was very helpful. Somehow I was thinking that

> NTFS

> would give me "network access". Share is the door, NTFS is the file

> cabinet,

> this is good!

>

> I also was somehow under the impression that SHARE-EVERYONE-FULL would

> give

> EVERYONE full access to files (edit, delete, etc). But now I see that

> SHARE-EVERYONE-FULL gives NO permissions unless NTFS also has EVERYONE (or

> the user in question) with some type of permission.

>

> I would really like to see the set of rules you are talking about, that

> would be great.

>

> Do you use any tools to audit you entire networks share and NTFS

> permissions?

>

> Thanks very much,

>

> Mark

>

> "Bruce Sanderson" wrote:

>

>> Think of the Share permissions as being the lock on the door and the NTFS

>> permissions as being the lock on the filling cabinet.

>>

>> The key to filling cabinet is useless if you can't get into the room.

>>

>> The computer uses the Share permissions to decide whether the user can

>> access the Share from another computer at all and what permissions will

>> be

>> through that Share. The folder and file NTFS permissions are effective

>> for

>> both local and remote access and give fine grained control over what the

>> user can do to the content. Share permissions have no affect on local

>> access (asuming the user is refering to the folder using the

>> DriveLetter:\

>> as opposed to \\ComputerName\ShareName syntax).

>>

>> The permissions that a user has when accessing through the Share is the

>> minimum of the Share and NTFS permissions. Thus if a user has Full

>> Control

>> via NTFS, they can do whatever they want when logged on locally. If the

>> Share permission is Read, then they can only read files from another

>> computer. If you like, the Share permission take precedence over the

>> NTFS

>> permission, but ONLY when the user is accessing via the Share (e.g. from

>> another computer).

>>

>> In many cases, it is useful set the Share Permissions to Everyone (or

>> Authenticated Users) Full Control and manage access control entirly using

>> the NTFS permissions only. This simplifies administration and

>> troubleshooting without really compromising file security.

>>

>> Share permissions were (are?) useful for file systems that do not have

>> built

>> in access control (e.g. FAT or FAT32). For systems like Windows 3.1, 95

>> etc. Share Permissions were the only way to control who could access

>> files

>> remotely. With NTFS, in most situations, the Share permissions don't add

>> anything to file security (access control) that is not already provided

>> by

>> the NTFS file system, thus the suggestion to set them Full Control for

>> all

>> users and simplify your life.

>>

>> A general rule in a domain, to simplify administration, is to NOT add

>> user

>> accounts to NTFS (or Share) permissions and not create local groups, but

>> to

>> always use domain groups whose name identifies the resource (share or

>> folder) and the granted permissions. That way you can tell who has

>> access

>> to what by reading the group membership in conjunction with the name of

>> the

>> group, entirely in AD Users and Computers. If you're interested I can

>> post

>> (or send you) a set of rules re. group membership etc. that have been

>> found

>> to be useful in this regard.

>>

>> --

>> Bruce Sanderson

>> http://members.shaw.ca/bsanders

>>

>> It is perfectly useless to know the right answer to the wrong question.

>>

>> "Mrpush" <Mrpush@discussions.microsoft.com> wrote in message

>> news:3FA2E0D4-AD75-4BF0-A410-1E6CC06B0FA4@microsoft.com...

>> > Hi,

>> >

>> > Did I say I can't stand Sharing and security on Windows?

>> >

>> > Ooops, just did.

>> >

>> > Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still

>> > makes

>> > little sense, but I'm getting better.

>> >

>> > What I need is a utility that would allow me to AUDIT my entire network

>> > and

>> > show me all my USERS and GROUPS and what permissions they have, that

>> > would

>> > be

>> > great!

>> >

>> > Is there any such utility? (freeware would be nice!)

>> >

>> > I'm aware of the "Effective Permissions" in the settings, but that is

>> > only

>> > good for a single person/group.

>> >

>> > I'd like to see a table of users and groups and then all the SHARE /

>> > NTSF

>> > permissions and what overrides what.

>> >

>> > Any ideas?

>> >

>> > Thanks much,

>> >

>> > Mark

>> >

>> > (P.S, - why would NTFS permission to "view" not have precedence over

>> > Share

>> > for viewing files or folders over the network? I'm still scratching my

>> > head!

>> > =) )

>>

February 20, 2008

Re: Share and NTSF permissions...

Bruce,

I reviewed your site, its good. Thanks!

Here is part of my frustration with Sharing and security.

I have folder shared as EVERYONE-READ.

I set SECURITY as EVERYONE-LIST FOLDER CONTENTS.

This allows me to SEE files in the folders over the network. However I get

an "access Denied" when I try to open them. Fine.

Here is the kicker. Go into SECURITY-EVERYONE-LIST FOLDER CONTENTS-ADVANCED

and it has checked:

Traverse/Execute file

List Folder/read data

Read Atributes

Read Extended Attributes

Read Permissions

Ok. I cannot READ ANY data or EXECUTE any file. So why would the first 2 in

the list be checked???? (they should not be!)

Now, go back into SECURITY-EVERYONE- and check READ instead of List Folder

Contents.

Now goto advanced. ITS HAS THE SAME GRANDULAR ITEMS CHECKED AS ABOVE but

now allows me full acces to open and read files!

This is the screwiest thing I have ever seen! WHY???????

Comments?

Thanks,

Mark

"Bruce Sanderson" wrote:

> Think of the Share permissions as being the lock on the door and the NTFS

> permissions as being the lock on the filling cabinet.

>

> The key to filling cabinet is useless if you can't get into the room.

>

> The computer uses the Share permissions to decide whether the user can

> access the Share from another computer at all and what permissions will be

> through that Share. The folder and file NTFS permissions are effective for

> both local and remote access and give fine grained control over what the

> user can do to the content. Share permissions have no affect on local

> access (asuming the user is refering to the folder using the DriveLetter:\

> as opposed to \\ComputerName\ShareName syntax).

>

> The permissions that a user has when accessing through the Share is the

> minimum of the Share and NTFS permissions. Thus if a user has Full Control

> via NTFS, they can do whatever they want when logged on locally. If the

> Share permission is Read, then they can only read files from another

> computer. If you like, the Share permission take precedence over the NTFS

> permission, but ONLY when the user is accessing via the Share (e.g. from

> another computer).

>

> In many cases, it is useful set the Share Permissions to Everyone (or

> Authenticated Users) Full Control and manage access control entirly using

> the NTFS permissions only. This simplifies administration and

> troubleshooting without really compromising file security.

>

> Share permissions were (are?) useful for file systems that do not have built

> in access control (e.g. FAT or FAT32). For systems like Windows 3.1, 95

> etc. Share Permissions were the only way to control who could access files

> remotely. With NTFS, in most situations, the Share permissions don't add

> anything to file security (access control) that is not already provided by

> the NTFS file system, thus the suggestion to set them Full Control for all

> users and simplify your life.

>

> A general rule in a domain, to simplify administration, is to NOT add user

> accounts to NTFS (or Share) permissions and not create local groups, but to

> always use domain groups whose name identifies the resource (share or

> folder) and the granted permissions. That way you can tell who has access

> to what by reading the group membership in conjunction with the name of the

> group, entirely in AD Users and Computers. If you're interested I can post

> (or send you) a set of rules re. group membership etc. that have been found

> to be useful in this regard.

>

> --

> Bruce Sanderson

> http://members.shaw.ca/bsanders

>

> It is perfectly useless to know the right answer to the wrong question.

>

> "Mrpush" <Mrpush@discussions.microsoft.com> wrote in message

> news:3FA2E0D4-AD75-4BF0-A410-1E6CC06B0FA4@microsoft.com...

> > Hi,

> >

> > Did I say I can't stand Sharing and security on Windows?

> >

> > Ooops, just did.

> >

> > Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still

> > makes

> > little sense, but I'm getting better.

> >

> > What I need is a utility that would allow me to AUDIT my entire network

> > and

> > show me all my USERS and GROUPS and what permissions they have, that would

> > be

> > great!

> >

> > Is there any such utility? (freeware would be nice!)

> >

> > I'm aware of the "Effective Permissions" in the settings, but that is

> > only

> > good for a single person/group.

> >

> > I'd like to see a table of users and groups and then all the SHARE / NTSF

> > permissions and what overrides what.

> >

> > Any ideas?

> >

> > Thanks much,

> >

> > Mark

> >

> > (P.S, - why would NTFS permission to "view" not have precedence over Share

> > for viewing files or folders over the network? I'm still scratching my

> > head!

> > =) )

>

February 21, 2008

Re: Share and NTSF permissions...

Thank you for the complement!

In the Permissions lists, the part of an entry to the left of "/" is the

permission that pertains to Folder objects; the part to the right is the

permission that relates to File objects.

The "List Folder" (aggregated) permission deliberately specifies that the

settings apply ONLY for folder objects, NOT for File objects. In the

"Advanced Security Settings for ..." dialog box observe the column called

"Apply to". For the "List Folder" (aggregated) permissions, "Apply to" says

"This folder and subfolders" - there is no mention of Files. Click Edit and

observe the same thing in the "Apply onto" box, which you can change if you

want to. When you select the "Read" or "Read and Execute" (aggregated)

permission, the "Apply to" changes to "This folder, subfolders and files".

So, the "List Folder" (aggregated) setting on the Security tab of the

folder's Properties applies the following permissions to Folders:

Traverse Folder

List Folder

Read Attributes

Read Extended Attributes

Read Permissions

And absolutely NO permissions at all for Files. Since Users (in your case)

have NO PERMISSIONS specified for Files, they can see the list of them, but

get "access is denied" if they try to open them.

The List Folder (aggregated) setting is useful if you want users to be able

to navigate THROUGH a folder (e.g. in Windows Explorer) to subfolders, but

not read anything that is in it, just things to which they have been grated

Read permission for Files in sub-folders.

If you change anything in Advanced, Edit dialog (e.g. the setting in "Apply

onto"), you will most likely see a check mark beside "Special" in the

Security tab of the ...Properties dialog because you have specified

something that is not covered by any of the aggregated settings shown on

that dialog.

So, it's not "screwy", it is "by design". You can do some very complicated

(and consequently confusing, particularly months later!) things with NTFS

permissions, so a little experimenting and study might go a long way. I

suggest keeping things as simple as you possible can commensurate with

satisfying (REAL) business needs.

--

Bruce Sanderson

http://members.shaw.ca/bsanders

It is perfectly useless to know the right answer to the wrong question.

"Mrpush" <Mrpush@discussions.microsoft.com> wrote in message

news:D8273890-5289-44C9-8ED4-A3DD30960CA6@microsoft.com...

> Bruce,

>

> I reviewed your site, its good. Thanks!

>

> Here is part of my frustration with Sharing and security.

>

> I have folder shared as EVERYONE-READ.

>

> I set SECURITY as EVERYONE-LIST FOLDER CONTENTS.

>

> This allows me to SEE files in the folders over the network. However I

> get

> an "access Denied" when I try to open them. Fine.

>

> Here is the kicker. Go into SECURITY-EVERYONE-LIST FOLDER

> CONTENTS-ADVANCED

> and it has checked:

>

> Traverse/Execute file

> List Folder/read data

> Read Atributes

> Read Extended Attributes

> Read Permissions

>

> Ok. I cannot READ ANY data or EXECUTE any file. So why would the first 2

> in

> the list be checked???? (they should not be!)

>

> Now, go back into SECURITY-EVERYONE- and check READ instead of List Folder

> Contents.

>

> Now goto advanced. ITS HAS THE SAME GRANDULAR ITEMS CHECKED AS ABOVE but

> now allows me full acces to open and read files!

>

> This is the screwiest thing I have ever seen! WHY???????

>

> Comments?

>

> Thanks,

>

> Mark

>

> "Bruce Sanderson" wrote:

>

>> Think of the Share permissions as being the lock on the door and the NTFS

>> permissions as being the lock on the filling cabinet.

>>

>> The key to filling cabinet is useless if you can't get into the room.

>>

>> The computer uses the Share permissions to decide whether the user can

>> access the Share from another computer at all and what permissions will

>> be

>> through that Share. The folder and file NTFS permissions are effective

>> for

>> both local and remote access and give fine grained control over what the

>> user can do to the content. Share permissions have no affect on local

>> access (asuming the user is refering to the folder using the

>> DriveLetter:\

>> as opposed to \\ComputerName\ShareName syntax).

>>

>> The permissions that a user has when accessing through the Share is the

>> minimum of the Share and NTFS permissions. Thus if a user has Full

>> Control

>> via NTFS, they can do whatever they want when logged on locally. If the

>> Share permission is Read, then they can only read files from another

>> computer. If you like, the Share permission take precedence over the

>> NTFS

>> permission, but ONLY when the user is accessing via the Share (e.g. from

>> another computer).

>>

>> In many cases, it is useful set the Share Permissions to Everyone (or

>> Authenticated Users) Full Control and manage access control entirly using

>> the NTFS permissions only. This simplifies administration and

>> troubleshooting without really compromising file security.

>>

>> Share permissions were (are?) useful for file systems that do not have

>> built

>> in access control (e.g. FAT or FAT32). For systems like Windows 3.1, 95

>> etc. Share Permissions were the only way to control who could access

>> files

>> remotely. With NTFS, in most situations, the Share permissions don't add

>> anything to file security (access control) that is not already provided

>> by

>> the NTFS file system, thus the suggestion to set them Full Control for

>> all

>> users and simplify your life.

>>

>> A general rule in a domain, to simplify administration, is to NOT add

>> user

>> accounts to NTFS (or Share) permissions and not create local groups, but

>> to

>> always use domain groups whose name identifies the resource (share or

>> folder) and the granted permissions. That way you can tell who has

>> access

>> to what by reading the group membership in conjunction with the name of

>> the

>> group, entirely in AD Users and Computers. If you're interested I can

>> post

>> (or send you) a set of rules re. group membership etc. that have been

>> found

>> to be useful in this regard.

>>

>> --

>> Bruce Sanderson

>> http://members.shaw.ca/bsanders

>>

>> It is perfectly useless to know the right answer to the wrong question.

>>

>> "Mrpush" <Mrpush@discussions.microsoft.com> wrote in message

>> news:3FA2E0D4-AD75-4BF0-A410-1E6CC06B0FA4@microsoft.com...

>> > Hi,

>> >

>> > Did I say I can't stand Sharing and security on Windows?

>> >

>> > Ooops, just did.

>> >

>> > Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still

>> > makes

>> > little sense, but I'm getting better.

>> >

>> > What I need is a utility that would allow me to AUDIT my entire network

>> > and

>> > show me all my USERS and GROUPS and what permissions they have, that

>> > would

>> > be

>> > great!

>> >

>> > Is there any such utility? (freeware would be nice!)

>> >

>> > I'm aware of the "Effective Permissions" in the settings, but that is

>> > only

>> > good for a single person/group.

>> >

>> > I'd like to see a table of users and groups and then all the SHARE /

>> > NTSF

>> > permissions and what overrides what.

>> >

>> > Any ideas?

>> >

>> > Thanks much,

>> >

>> > Mark

>> >

>> > (P.S, - why would NTFS permission to "view" not have precedence over

>> > Share

>> > for viewing files or folders over the network? I'm still scratching my

>> > head!

>> > =) )

>>

February 21, 2008

Re: Share and NTSF permissions...

Bruce,

You have found my weakest link. I really payed little of no attention to

the "Apply onto:" field when checking the permissions.

I do undestand now. (but I still think the GUI could be setup better so

that it shows the permissions in an easier to understand format)

Thanks a million, you have been very helpful. I will try to keep things

really simple.

Mark

"Bruce Sanderson" wrote:

> Thank you for the complement!

>

> In the Permissions lists, the part of an entry to the left of "/" is the

> permission that pertains to Folder objects; the part to the right is the

> permission that relates to File objects.

>

> The "List Folder" (aggregated) permission deliberately specifies that the

> settings apply ONLY for folder objects, NOT for File objects. In the

> "Advanced Security Settings for ..." dialog box observe the column called

> "Apply to". For the "List Folder" (aggregated) permissions, "Apply to" says

> "This folder and subfolders" - there is no mention of Files. Click Edit and

> observe the same thing in the "Apply onto" box, which you can change if you

> want to. When you select the "Read" or "Read and Execute" (aggregated)

> permission, the "Apply to" changes to "This folder, subfolders and files".

>

> So, the "List Folder" (aggregated) setting on the Security tab of the

> folder's Properties applies the following permissions to Folders:

>

> Traverse Folder

> List Folder

> Read Attributes

> Read Extended Attributes

> Read Permissions

>

> And absolutely NO permissions at all for Files. Since Users (in your case)

> have NO PERMISSIONS specified for Files, they can see the list of them, but

> get "access is denied" if they try to open them.

>

> The List Folder (aggregated) setting is useful if you want users to be able

> to navigate THROUGH a folder (e.g. in Windows Explorer) to subfolders, but

> not read anything that is in it, just things to which they have been grated

> Read permission for Files in sub-folders.

>

> If you change anything in Advanced, Edit dialog (e.g. the setting in "Apply

> onto"), you will most likely see a check mark beside "Special" in the

> Security tab of the ...Properties dialog because you have specified

> something that is not covered by any of the aggregated settings shown on

> that dialog.

>

> So, it's not "screwy", it is "by design". You can do some very complicated

> (and consequently confusing, particularly months later!) things with NTFS

> permissions, so a little experimenting and study might go a long way. I

> suggest keeping things as simple as you possible can commensurate with

> satisfying (REAL) business needs.

>

> --

> Bruce Sanderson

> http://members.shaw.ca/bsanders

>

> It is perfectly useless to know the right answer to the wrong question.

>

> "Mrpush" <Mrpush@discussions.microsoft.com> wrote in message

> news:D8273890-5289-44C9-8ED4-A3DD30960CA6@microsoft.com...

> > Bruce,

> >

> > I reviewed your site, its good. Thanks!

> >

> > Here is part of my frustration with Sharing and security.

> >

> > I have folder shared as EVERYONE-READ.

> >

> > I set SECURITY as EVERYONE-LIST FOLDER CONTENTS.

> >

> > This allows me to SEE files in the folders over the network. However I

> > get

> > an "access Denied" when I try to open them. Fine.

> >

> > Here is the kicker. Go into SECURITY-EVERYONE-LIST FOLDER

> > CONTENTS-ADVANCED

> > and it has checked:

> >

> > Traverse/Execute file

> > List Folder/read data

> > Read Atributes

> > Read Extended Attributes

> > Read Permissions

> >

> > Ok. I cannot READ ANY data or EXECUTE any file. So why would the first 2

> > in

> > the list be checked???? (they should not be!)

> >

> > Now, go back into SECURITY-EVERYONE- and check READ instead of List Folder

> > Contents.

> >

> > Now goto advanced. ITS HAS THE SAME GRANDULAR ITEMS CHECKED AS ABOVE but

> > now allows me full acces to open and read files!

> >

> > This is the screwiest thing I have ever seen! WHY???????

> >

> > Comments?

> >

> > Thanks,

> >

> > Mark

> >

> > "Bruce Sanderson" wrote:

> >

> >> Think of the Share permissions as being the lock on the door and the NTFS

> >> permissions as being the lock on the filling cabinet.

> >>

> >> The key to filling cabinet is useless if you can't get into the room.

> >>

> >> The computer uses the Share permissions to decide whether the user can

> >> access the Share from another computer at all and what permissions will

> >> be

> >> through that Share. The folder and file NTFS permissions are effective

> >> for

> >> both local and remote access and give fine grained control over what the

> >> user can do to the content. Share permissions have no affect on local

> >> access (asuming the user is refering to the folder using the

> >> DriveLetter:\

> >> as opposed to \\ComputerName\ShareName syntax).

> >>

> >> The permissions that a user has when accessing through the Share is the

> >> minimum of the Share and NTFS permissions. Thus if a user has Full

> >> Control

> >> via NTFS, they can do whatever they want when logged on locally. If the

> >> Share permission is Read, then they can only read files from another

> >> computer. If you like, the Share permission take precedence over the

> >> NTFS

> >> permission, but ONLY when the user is accessing via the Share (e.g. from

> >> another computer).

> >>

> >> In many cases, it is useful set the Share Permissions to Everyone (or

> >> Authenticated Users) Full Control and manage access control entirly using

> >> the NTFS permissions only. This simplifies administration and

> >> troubleshooting without really compromising file security.

> >>

> >> Share permissions were (are?) useful for file systems that do not have

> >> built

> >> in access control (e.g. FAT or FAT32). For systems like Windows 3.1, 95

> >> etc. Share Permissions were the only way to control who could access

> >> files

> >> remotely. With NTFS, in most situations, the Share permissions don't add

> >> anything to file security (access control) that is not already provided

> >> by

> >> the NTFS file system, thus the suggestion to set them Full Control for

> >> all

> >> users and simplify your life.

> >>

> >> A general rule in a domain, to simplify administration, is to NOT add

> >> user

> >> accounts to NTFS (or Share) permissions and not create local groups, but

> >> to

> >> always use domain groups whose name identifies the resource (share or

> >> folder) and the granted permissions. That way you can tell who has

> >> access

> >> to what by reading the group membership in conjunction with the name of

> >> the

> >> group, entirely in AD Users and Computers. If you're interested I can

> >> post

> >> (or send you) a set of rules re. group membership etc. that have been

> >> found

> >> to be useful in this regard.

> >>

> >> --

> >> Bruce Sanderson

> >> http://members.shaw.ca/bsanders

> >>

> >> It is perfectly useless to know the right answer to the wrong question.

> >>

> >> "Mrpush" <Mrpush@discussions.microsoft.com> wrote in message

> >> news:3FA2E0D4-AD75-4BF0-A410-1E6CC06B0FA4@microsoft.com...

> >> > Hi,

> >> >

> >> > Did I say I can't stand Sharing and security on Windows?

> >> >

> >> > Ooops, just did.

> >> >

> >> > Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still

> >> > makes

> >> > little sense, but I'm getting better.

> >> >

> >> > What I need is a utility that would allow me to AUDIT my entire network

> >> > and

> >> > show me all my USERS and GROUPS and what permissions they have, that

> >> > would

> >> > be

> >> > great!

> >> >

> >> > Is there any such utility? (freeware would be nice!)

> >> >

> >> > I'm aware of the "Effective Permissions" in the settings, but that is

> >> > only

> >> > good for a single person/group.

> >> >

> >> > I'd like to see a table of users and groups and then all the SHARE /

> >> > NTSF

> >> > permissions and what overrides what.

> >> >

> >> > Any ideas?

> >> >

> >> > Thanks much,

> >> >

> >> > Mark

> >> >

> >> > (P.S, - why would NTFS permission to "view" not have precedence over

> >> > Share

> >> > for viewing files or folders over the network? I'm still scratching my

> >> > head!

> >> > =) )

> >>

>

February 21, 2008

RE: Share and NTSF permissions...

"Mrpush" wrote:

> Hi,

>

> Did I say I can't stand Sharing and security on Windows?

>

> Ooops, just did.

>

> Anyway, I'm studying hard on how to understand Sharing vs NTFS. Still makes

> little sense, but I'm getting better.

>

> What I need is a utility that would allow me to AUDIT my entire network and

> show me all my USERS and GROUPS and what permissions they have, that would be

> great!

>

> Is there any such utility? (freeware would be nice!)

>

> I'm aware of the "Effective Permissions" in the settings, but that is only

> good for a single person/group.

>

> I'd like to see a table of users and groups and then all the SHARE / NTSF

> permissions and what overrides what.

>

> Any ideas?

>

> Thanks much,

>

> Mark

>

> (P.S, - why would NTFS permission to "view" not have precedence over Share

> for viewing files or folders over the network? I'm still scratching my head!

> =) )

February 21, 2008

Re: Share and NTSF permissions...

I'm not sure where to ask this but my question related to share folder

permissions. We have 5 main folders on a shared drive. Only our IT

administrator has full control to either delete one of these folders or to

create a new one. Within those main folders all users have read/write/modify

permissions. They can create subfolders but cannot delete subfolder. But I

just had a problem where someone dragged and dropped one of the main folders

into another one. I was then unable to pull that folder back out because I

don't have permissions to enable that. Is there a restriction that can be

used so that an individual would be prevented from dragging and dropping?

I do not see anything in the permissions list that would prevent the dragging

and dropping.