Networks

Ask something
Question Locked

SBS 2003 Group Permissions simply do not work :(

0 helpful
7 replies

by paul cheeseman 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi

I have a SBS2003 server, SP1, with 30 users. on one of 3 sites.

When I create a share, and assign a group to its permission tab, none of the group members get any permissions at all ...

If I individually assign each member the same permission to the same share, it works fine.

I have set up and tested many shares/groups/users whilst trying to get this to work, and it ONLY works when I give each person permission to use that share.

I have a similar setup on the other sites, and it works fine. (The sites are not linked in any way)

I can only assume for whatever reason that the groups are broken (I have tried global and universal group types)..... I do not know how to fix this. can anyone give me some idea either what is going on, or how to fix it please ??

Method as it works on the other sites: On server/share/properties assign group permission under 'share permissions' with (in this case) full control. Put members in said group. Members get permission for that share.

I have both Distribution groups and security groups setup. All the distribution groups work fine, its only the security groups that dont work.

Test scenario: Created a test folder, and a new global security group. Made sure that no other inherited permissions applied to that group/folder

added myself into security group. Access denied.

Added myself directly to the folder permissions, got access.

It didnt matter who I put IN the new group, group members could not access the new folder unless they were listed individually.

This experiment was repeatable on any folder.

I have totally run out of steam trying to sort this, does ANYONE have any idea how I can go about fixing this problem please?

Regards

Paul

7 replies

by cg it

share permissions on SBS works the same as on any Windows AD domain.

Rule of thumb

share permissions determine access over the network.

Files and folders in a share have the same permissions as the share unless you restrict the permissions further.

permissions are assigned by groups and individual user accounts.

users can only access a folder when they are granted permission to do so or belong to a group that has permission.

Avoid configuring both share and NTFS permissions. what this means is assign NTFS permissions to a folder or file using security group membership. Share a folder. Remove the everyone group. add the domain users security group which all users of the domain are members of to share permissions.

The combination of share folder permissions and NTFS permissions apply with most restrictive applying.

by paul cheeseman

Yes, I totally agree with what you have stated, but unfortunately, on this site, it simply doesnt work.

On both the other sites, it works exactly as it should (how you have stated)

On the site in question, It doesnt matter how I set the permission for the security group, members do not get access until it is assigned on an individual user basis.

Believe me, I have tried every combination I could think of to get this to work, giving the group(s) full permission with both NTFS and Share has no effect whatsoever until i give the user permission.

by paul cheeseman

I have kinda let this sit in the background. No one it seems has any idea outside those I have already tried as to why this happens. Someone did sugest that a MS patch 'broke' something (surely not!!!) but without a total rebuild/reinstall, I feel I am just banging my head againg a wall trying to fix it.

Oh well

Paul

by wmanigault

I have seen this behavior at our site. I find that if I create a new group and put myself in it I don't have the permissions of the group unless I log off then back on.

I assumed you have done that?

Here is how it works for me on Windows/2003 SP1.

Create a folder
Assign group permissions
Try to access folder (access denied)
Add self to group
Try to access folder (access denied)
Logoff and then back on
Try to access folder (successful)

The user must log off then back on to pick up the new permissions or run a gpupdate at the workstation where the user is logged on at.

by business.jason.walter

I recently installed Windows 2003 SBS onto my organization's server. We had the same issues. I was trying to create roaming profiles for all of the regular users of the network so their profiles would be carried from computer to computer. Well, I created the folder, set the permissions, and found out that it didn't work. Every time the user logged onto the network they got an error message telling them they didn't have access to the network resource. I'm assuming you're getting a similar message.

Well, to make a long story short, I had made a mistake the first time I set up NTFS/share permissions on the folder. So, I fixed my mistake by assigning the appropriate person the permissions they needed to read and write to the folder. Well, it still didn't work. I tried a gpupdate on the server as well as two or three other machines on the network and found that the problem followed the user logging on no matter what machine they tried to log into.

All that being said, I would try to look into "cached" shared and folder permissions. When I installed and set up SBS it, by default, cached login information as well as my folder permissions and share permissions. So, for some reason when I updated the permissions, the server still continued to use the cached permissions. I couldn't find how to delete these cached logon/folder permission/share permission settings so I ended up have to go through the registry on my server and correct ever instance of the mistake where, in fact, the wrong permissions were stored.

This may not make a lot of sense, as I'm not really good at explaining things in detail and having them make sense. Not a gift of mine. So, if you have any questions, feel free to ask me. I hope this mabye helps you out.

Jason

This discussion is closed to new replies.