Windows Forum

Ask something
Discussion Locked

NTFS permissions

0 helpful
9 replies

by rabbit_runner

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have a web server that is giving us problems with NTFS permissions. Recently, some of the permissions for folders on the server, changed. The reason is unknown. Upon finding the problem, we set about to change the permissions back to what we were wanting. Problem, the permissions would NOT filter down through the files and subfolders. An Example, We added a user and also added a group to a high level folder on an NTFS partition (NT4SP6a). Permissions were set as RWX. Then we set to filter those permissions to all sub folders and files. Upon checking all lower level files, they would have the RW only, but not the execute. Then removed a user and removed a group. Re added with full control, and checked both boxes to make certain that all files and folders would have those persmissions. When we checked the files and folders, the permissions would only be read only. nothing else. We have had several techs working on this and cannot find a soulution. Technet had not revealed anything like this.
This server is a PDC, has several web sites, home for several SQL server databases, and is a backup server using Veritas Backup Exec.

Has anyone heard of this type of problem? If more information is needed, I can provide anny additonal data to specific questions. This really has us puzzled.

9 replies

by rabbit_runner

Note: It has NAV installed and the DAT files are up to date. All patches are applied, and it sits in a DMS. It is regularly scanned to discover any vulnerabilities and any discovered are corrected. The server and sites are quite secure, so the possibility of a hacker gaining access, is really not likely.

by aschaffer

This is not so much a fix, as clarification. You verified that the sub directories don't have the permissions explictly set on them, and that they are set to inherit permissions from parent folders?

by rabbit_runner

What I attempted to state was this, for Example there is a folder named "DATA". Then under that there are four folders named Data1, Data2, Data3, and Data4. Also there are numerous files in each folder, this includes files in the DATA folder. For a particular user or group, an example would be "PETE". He has been given RWX permissions on all files and folders under the Data Folder. What we discovered was that all of his permissions were changed to RW, but not X. When we attempted to change Pete's permissions for the entire directory and sub folders, We would attempt to apply the RWX permissions, and allow it to filter down to all sub folders and files. We would select the Advanced button of the Security properties on the DATA folder. Then make the necessary changes. Also we would select the check box "Reset permissions on all child objects and enable propagation of inheritable permissions". By doing this, all sub folders and files should have Pete's permissions changed to RWX. But what we found was that the permissions would be changed to R only. If we removed Pete's permissions completely from this directory tree, then re-added Pete with the RWX permissions and attempted to propigate to all sub folders, they would again only be RW. We even found that when we manually changed Pete's permissions to the files and folders to RWX, after a few minutes they would change to RW only. So what 'gives'? It has us puzzled.

by nettek

From your additional description on answer #1, it sounds as if you are trying to modify NTFS 4 permissions (NT4SP6a) from an NTFS 5 machine (Windows 2000). If these permissions do not agree, the NT 4 machine will override the settings as seen in theWindows 2000 machine.

The Read permission on a folder on an NT 4 machine includes the Execute permission. My guess is that when you view the permissions of the NT 4 folder from a 2000 machine, the NT 4 machine is telling the 2000 machine, "The folder has Read and Write." Because the Read permission includes Execute, the NT 4 machine is not passing a seperate Execute permission down to the 2000 machine for viewing.

If you go to the NT 4 machine, check the Data folder's Security -> Permissions, you will probably see RXW.

by rabbit_runner

We have attempted to use the NTFS 4 permissions and NTFS 5 permissions to change. Neither one will correct the problem. We have tried both, as a means to correct the problem, neither will fix the issue. We are thinking something is wrong with the OS, but we fear it may lead to a complete reload. That would be a big problem because of the web sites, SQL databases, and it being a PDC.

by rabbit_runner

To add additional information.
We have tried 1)sitting at the console of the NT4 server and attempted to change the file permissions. This did not work. 2) We connected through a share, from a Win2k Pro box, and tried to change the permissions, this also did not work. 3) We have also attempted to change the permissions using DameWare. This also failed to make the necessary and needed changes. It seems that any method we attempt to use, we get the same problem.

by rabbit_runner

Thanks for your input, but your suggestion did not work. We are truelly puzzled by this problem. It looks like we will need to migrate these web sites to another server, then also migrage the SQl databases to another server. At that point we can then leave the system as a PDC.

This discussion is closed to new replies.