Software

Ask something
Question Locked

Active Directory

0 helpful
5 replies

by ayje

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi all,
THis is the situation, I am trying to deny access to a group call users to a folder that is inside another folder. Lets say deny access to all users to folder \\server\folder1\folder2.
I just want few people who are part of the users to have access to folder2.
When I deny users and add the specify users it works fine but the "big guy" the admin account also get denied. Do I have to then add the "big guy manually?

5 replies

by faradhi

I assume that the folder is shared at the level of \\server\folder1 with a group, lets call it [i]groupies[/i] having full access at the share level. Further, the [i]groupies[/i] group has the appropriate NTFS permissions. Now, you are trying to deny access to the folder2 directory to all but a subset of users in the [i]groupies[/i] group. There are a few approaches:

First is to create a new share in a different location on the server called \\server\folder2 to which only a group , lets call it [i]subgroupies[/i], have the appropriate rights. This would be my first choice.

OR

You could create a group, lets call it [i]deniedgroupies[/i] and place everyone whom you do not want to have access, and explicitly deny NTFS rights to the folder.

OR

A third option, you could remove inherited rights from the folder2, grant [i]subgroupies[/i] the appropriate NTFS rights to folder2.

Remember that when determining which level of rights applies when working which share level and NTFS level, it is always the most restrictive rights always apply. Therefore to simplify things, I would keep the share level rights as Full Access and use NTFS rights to restrict.

I hope this helps.

by ayje

I would suggest this approch to the Senior Admin. However, for some reason now after we played around deny all users and then add the specify people one at the time, we changed everything to original configuration and now the admin and account and the users have access deny. I believe they reboot the server to see if it would return to normal.
We do not know what happened
Thank for your help
Faradhi

by ayje

The Senior Admin, decided to run a utility called Icacls, this is supposed to remove all NTFS rights from a epcify folder or files. After running the command he was able to add the admin account and had to access to the folder as well as the users. They did not tell what was the final approched to resolve the issue.
AP

by faradhi

Icalcs cleared the deny ACL which allowed the administrator access again.

When you explicitly deny rights, the deny takes precedence over all other rights. So you should not use deny to all users ever.

My suggestion was to deny only the users you did not want to have access.

Glad you got it working.

This discussion is closed to new replies.