Security

Ask something
Discussion Locked

Windows 2000 Permissions, Rights, Etc.

0 helpful
14 replies

by mrs_doctor_jones

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Does anyone have any good, concise resources for Windows 2000 rights, permissions, ownership, etc.

Right now we're kind of winging it and keep running into problems with people being locked out of files and folders.

I need info on "what to do if x happens."

14 replies

by mrs_doctor_jones

Thanks, the first two were informative and will help me educate those who need to know about the subject but know even less than I do at this point.

However I am more concerned about what to do when someone loses rights due to a system problem. I've encountered a problem lately where the admin has lost rights to folders created by other users on the network and was able to see the files inside that folder but not open them. That's how I learned about the "take ownership" option.
It's things like that which I need to know more about.

by lordinfidel

There really is not a "what if this happens" type of doc.

It's basically, you learn the proper way to assign rights and don't deviate from it.

The hard and fast rules are:

Admins (domain and local) and System are the only ones who are granted full control over any files (no matter what!)

Users (any one other then the admin group) are granted nothing higher then change. Never Full.

Domain admins/Local admins are the only group that can take ownership of files.

Never control access thru share permissions, share permissions should always be everyone=full.

Never give NTFS permissions everyone=full.

An example would be a users home directory:
Admins = Full
System = Full
User = Change

Another tip- Only assign groups to folders never individual users. With the exception of the users home folder.

Why? 2 reasons. 1, it makes it easier to add more people to the resource by just adding them to the resources group. And 2, If I the hacker, enumerated the rights on a resource and found usernames, I then have a valid username to use/try out.

Also, I always prefer to use the Local Administrators group when doing permissions rather then Domain Admins. As long as a machine is joined to the domain, then thedomain admin group is automatically in the local admin group.

With these basic concepts you should be able to administer your permissions.

by timwalsh

I fear that you may be looking for something that doesn't exist.

All the resources I have seen will explain about permissions, rights, etc. and some will offer basic troubleshootinginformation. But I don't think you will ever find a "if this happens, this will fix it" type of resource. There are too many different things that can possibly go wrong.

That's why forums such as this tend to be popular.

The first person to create a resource such as you are looking for, will become an instant millionaire.

The good news is that if you have specific questions, SOMEONE will usually be able to propose a solution the works.

by mrs_doctor_jones

1. Win 98 and 95 users connecting to Win2K Pro "server." Can connect one day, can't connect the next. Getting message that device doesn't exist on network. Passwords didn't expire. Permissions still in place. Only thing that works is creating new user name and pw on server and on client.

2. Users and admin have permissions for different folders and can view file contents. Can access some files within the folder but can't access others.

by lordinfidel

Ok now we have some clarification.

You are not in a domain setting.

So any user name and password that your users log in with on the 95/98 machine has to match what ever you create on the 2k pro machine. If they mistype their password they will still be allowed in to the 95/98 machine but not the 2K machine.

If they press cancel, same thing. It is the pwd on the 98/95 machine that is getting messed up, not on the 2k pro machines.

You are not in a true domain model where they need to log into the domain.

Also, if the 95/98 machines can not find the 2k pro machine, then make sure that you can ping the 2k pro machine by IP, then ping it by host name, then try to browse to it thru netwk neighbourhood(msp?)

2. This has to do with cascading permissions.

If when the top level folder permission was set and you did not cascade the permsisions down, then whatever the original permissions were on the file level will not be changed.

When you change the top level folder permissions, click on advanced and apply the changes to all subfolders, and files. (will be 2 check boxes on the bottom)

by mrs_doctor_jones

I understand what you are saying about the 95/98 machines. That was kind of a given.

However, I'm pretty sure that it wasn't an issue of mistyping the password. I tried it myself to make sure that wasn't the issue.

During one of the incidents I actually had someone in the office who claims to know a bit more about this stuff than I do. He said it was a problem with the 98 machine changing its IP address.

Is there any way to tell if this was actually the problem? And if so, would it be better to assign an IP address to each machine rather than letting the system automatically do it?

by mrs_doctor_jones

Trying to copy a directory but keep getting an error that the file is in use and can't be copied. I know for certain that it is no longer in use.

by grannybear

HI!

Since TechRepublic keeps these threads alive for a time, we could post as-we-learn-it scenarios for security problem/solution sets.

Just a thought from a mid-life career-changling IT network security newbie...;)

Grannybear
"Take the Shoes Off Your Mind!"

by lordinfidel

I've been re architecting our network.

When you say the system chooses the IP, are you saying that you are using DHCP?, or is the OS automatically assigning a 169.x.x.x address to itself.

That is not a routable address, that is a 'apipa' address that the os/nic assigns to itself when it can not get a dhcp address and does not have an address assigned to it.

That would be a very big problem in terms of communication.

by lordinfidel

If the nic assigns itslef an IP that is not in your range.

Usually it will mean that it could not get an adress from a dhcp server. If you do not have a dhcp server on the ntwk you willl need to assign a static IP to the nic.

If you do have adhcp server are there enough address' in the scope.
And if the system could not contact the server (nic did not start up in time) then it would assign an address like that.

by mcs-1

I ran into a problem similar in nature to yours on a client's network. Rights and permissions were all over the place, half the systems on the n/w had fixed IP's, DHCP servers fighting for number control ..... a real dog's breakfast. Most of it from everybody in the office being a computer guru one day or the next, and everybody's "I know why..." troubleshooting techniques. Anyway, instead of trying to fix what was already a mess we pretty much pulled all the machines back to default, did a quick layout of machine/user (for rights and permissions) and then implemented it on the network. Once a policy was established that the "guy down the hall" can no longer be the net admin (until something goes wrong and then he scurries back to his office down the hall), and we had an roadmap of what was going on things started working ok. Granted, this work did take the better part of two days with myself and one other technician working on it, but it has already saved countless hours of downtime trying to troubleshoot the problems you are facing now.

Sorry that wasn't an answer to your question, but I just thought I'd throw in my two cents. You may want to think about trashing the whole thing and establishing a policy you can work with .... before your problem compounds.

by lordinfidel

When I started at this job centuries ago, their permission/file server scheme was archaic and unmanageable.

Everyone and anyone could put files wherever they wanted. I had to do a lot of deep folder level permissions that had no rhyme or reason to it.

It was just a mess.

One day I got fed up, created a file structure that made sense (departmentalized each area) Created logical groupings of users. And over a weekend moved ALL of the files into their respective areas.

The users grumbled for about a month until they got used to it. But then they got happy once they realized that they know where their files are and they do not have to go searching for them.

Plus now, when I need to give access to someone, I just add them to the group that has the appropiate access, have them log off/on, and poof their in.

This discussion is closed to new replies.