Application Rights

I did consider the idea of suggesting putting a pre & post execution script to the application to call filer, but then the person using filer would need the A right (or S to the parent) in order to grant the rights and so it rather defeats the wholeobjective!
This is the sort of thing that sounds as if it could be useful, but have you considered the potential for delays (supposing you do find a way fo doing it)? I don't know how big a partition you have (nor how many replicas) but the constant granting & repealing of rights would hit the NDS quite hard in terms of all the additional replication traffic flying around, so much so that it may cause delays unacceptable to your users.
Having said all that, I would be interested if its possible. Please drop me a line if you're successful.

regards

Roger

Indeed *very* hard to implement. It shows the general limitations of 1st generation file-sharing apps versus 2nd generation client/server apps (SQL etc.) or 3rd generation web apps. Both of these are much easier to secure.
In our organisation, of course next to moving slowly towards 2nd and 3rd generation apps, we solve this problem in a way which might be interesting to you. We use NT or preferably W2K workstations with 'multiple identity' (Run-As, and e.g. the VDESK tool from the resource kit). When the user runs that secured app, a session is opened which does allow access to the files but doesn't have a 'desktop' from which to run Explorer or start other apps. When the app is finished, the session is closed. So the fact that Novell gives the _user_ those rights is no problem anymore - for this app the user has a different Novell id than normal, an id _which he cannot use separately_ (password etc. only known to the system).

Hope this helps,

/ The Netherlands