Windows Forum

Ask something
Discussion Locked

Directory permissions

0 helpful
3 replies

by tunji

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
On Windows 2000 file server, I want to grant each user full control to his/her user directory so that he/she can grant permissions to other colleagues as required. At the same time, I want the domain admins to also have full control of the directories for ease of support. However, having full control, I anticipate a few clever guys can remove or change the domain admins permission. I want to be able have full access to the user directories whenever required without having to go through the process of taking ownership. Any suggestions will be appreciated.

3 replies

by swill57

If you give a user full control and ownership of an object, they can do anything they like, including removing admins, and I have seen users do it.

One thing you could do is force the user to break "Inheritance" in order for them to remove Admins. Set the object such that SYSTEM and Adminsistrators get "Inherited" full control of the user's home directory. Then, give the user account "Explicit" full control of the object.

This just means that the user will need to uncheck the "Inheritance" checkbox and say OK to its Security warning dialog. Since most users won't fully understand what this means, they will cancel it. That still doesn't stop the "amatuer administrator" from breaking the link and mucking up the works.

This discussion is closed to new replies.