Data Centers

TechProGuild FastAnswer: Troubleshooting permissions problems in Windows Server 2003 and Windows XP

Making sure users and groups have proper rights to shared resources can become complicated. Here's how you can troubleshoot conflicting permissions on Windows Server 2003 and Windows XP.

Save time. TechProGuild members can download the preformatted, ready-to-print version of this FastAnswer handout. The next time this problem arises in your organization, simply print and distribute the file directly to end users or members of your IT staff.

The problem

Properly securing the file system on your workstation or on a network server may seem like an easy enough task. You merely set permissions on a file or folder, granting the rights you want users to have, and you're done. Unfortunately, it's not always that easy. You may go through the effort of setting up groups, creating shares, and granting rights, only to discover that users can access things you didn't intend.

The cause

The most common cause of permissions problems arises from conflicting permissions. As you get more groups and users on your network, and you set permissions on files and folders, you may find that permissions granted to one group or user conflict with those set by another group or user. The more groups you have, along with multiple shares to manage, the greater your chances of having conflicting rights. This can cause unexpected results.

The solution

To help sort out the confusion, Microsoft created a feature in Windows XP and Windows Server 2003 known as Effective Permissions. You can use this feature to quickly and easily determine what a user's or group's actual permissions are to a resource. This can help you sort out conflicts and determine why a user can or can't access a resource. Here's how you make it work:

  1. In Windows Explorer, right-click the desired folder and select Properties.
  2. When the Properties window appears, click the Security tab and then click Advanced.
  3. On the Advanced Security Settings screen, click the Effective Permissions tab.
  4. Use the Select button to choose the user or group for which you want to view effective permissions.

In the Effective Permissions box at the bottom of the Advanced Security Settings window, you'll see the effective permissions for the object. The results shown are based on the permissions granted to the user account as well as the permissions granted to any groups the user is a member of. It also takes into account the permissions received from the parent object.

Additional tips

The Effective Permissions box displays permissions only for the specific object. You can't make any changes to the permissions from this window. You must do that either on the Security tab in properties or on the Permissions tab in the Advanced Security Settings window. In order to troubleshoot a permission that doesn't seem to be working correctly, start by checking the effective permissions for the specific object itself. Then check all of the groups that the object belongs to. You may also want to check any parent folders to see what rights exist at that level; these rights can be inherited.

Administrators, have you encountered difficulties in troubleshooting permissions problems? Of course you have! Effective Permissions provides you with a quick and easy way to help troubleshoot resource access.

Editor's Picks