Win2k NTFS Permissions

Permissions can be granted to individuals or groups. If a user has access to some files via a group that he belongs to, that can be overridden by having DENY on that specific user's account. If there was merely no ALLOW on that user, he would gainaccess via the group permissions.

BN

All NTFS permissions are cumulative. A users effective permissions for a resourse are the combination of the NTFS permissions that you give the individual user account and that you grant to any groups that that user account belongs to. For exampleif a user has read permission on a folder, and is a member of a group that has write permission on the same folder; the user has both read & write.

The Deny permission is the exception to the cumulative rule -- Deny overides everything. Even ifthe user has permission to access a file as a member of a group, denying permission to the user will block any permission that the user has.

The diference between checking "Deny" and just leaving the account of the list is it's easier just to leave the account off the list. If the user is not added they will not be allowed access impicitly. Microsoft recommends to use this only as needed.