Stupid question about server permissions

Question

Thanks for reading.

I have a share on a 2003 server that I would like to share with some of my domain users.

The share is currently empty, so n worries about permissions of subfiles/folders.

I have set it up with permissions as follows:

AccessGroup - Full permissions.
AccessGroup - Full shared permissions.
No other permissions defined at all.

I have added the users to the AccessGroup, but they can't enter the share across the network - it says access denied.

What am I missing here? Am I not understanding permissions, or do I need to flush something or...?

Thanks!

Edit Thanks for the comment. No, I am just testing it across the network myself from another workstation. Do I need to log out of my local workstation for changes on the server properties to take effect?

You mention, that you added users to the group. Have they logged out and in again since you made the change? — Zoredache, Dec 07 '10 at 23:52
@Eli: Yes, you need to log off and back on to "refresh" your group membership. — joeqwerty, Dec 08 '10 at 00:04
See this. http://www.petri.co.il/forums/showthread.php?t=35112 — Zoredache, Dec 08 '10 at 00:08
Hmm. No luck. I tried the method on that page, and klist ran as expected, but no luck with share access. — Eli, Dec 08 '10 at 00:19
That trick doesn't work on newer versions of Windows. You must log off and logon to the domain again. — Chris S, Dec 08 '10 at 01:41

score 2 · Answer 1 · answered Dec 08 '10 at 13:06

You've got two sets of permissions to worry about-- the underlying NTFS filesystem permissions (accessible via the "Security" tab of the "Properties" sheets of the shared folder) and the "Share Permissions" (accessible in Windows Server 2003 from the "Permissions..." button on the "Sharing" tab of the "Properties" sheets of the shared folder).

I'd recommend granting access via NTFS permissions only and leaving "Share Permissions" set to "Everyone / Full Control". The most restrictive combination of both permissions applies, but there's no advantage to setting restrictive permissions in both. (The "Share Permissions" comes from a time when the underlying filesystem might be one that doesn't have any permissions, like FAT.)

I'd set "SYSTEM / Full Control", "Administrators / Full Control", and "AccessGroup / Modify" (unless you need members of "AccessGroup" to be able to set permissions, in which case I'd give them "Full Control".)

Once you've done that you should see users who are members of the "AccessGroup" group as being able to access the share and read, write, and modify files and folders there.

Thanks for the answer. Unfortunately, that is basically what I have. Sharing permissions are full for Authenticated Users, and NTFS are full control for AccessGroup only. Still, people in the access group get permission denied when they try to access it. It really seems like it should be working. — Eli, Dec 09 '10 at 01:52

score 0 · Answer 2 · answered Dec 08 '10 at 05:29

0

Go to Properties of folder, go to security tab and assign a permission as required to user. This should resolve your issue.

Good Luck :)

answered Dec 08 '10 at 05:29

Ankur Dholakiya

458
2
9

No, assigning permissions using groups is perfectly acceptable and some would say the only sane way to go about it. – ThatGraemeGuy Dec 08 '10 at 15:13

Stupid question about server permissions

2 Answers2