1

Windows Server 2016 Standard... department/group's users were getting read permission errors within their department folder, gave them full control on folder and subs, then they got write permissions error ("You require permission from ZPICTURES\admin-zp to make changes to this file"), then gave each user in group full control of folder and subs, but still getting the same error message when trying to write or modify anywhere within ("You require permission from...").

I'm really confused now as this configuration works on another group's folder (actually, with just full control to group instead of all users). How do I fix this group's permission configuration so the group's users have write permissions?

crashintoty
  • 261
  • 1
  • 4
  • 11

2 Answers2

2
  • When you make a permission change the users need to logout and log back in for the changes to take effect.
  • I would advise against giving full control. That allows users to change permissions and take ownership of files. Modify rights should be sufficient for the vast majority of user's needs when it comes to shares.
  • Other users could have the files locked if they are accessing the same exact files.
  • In Windows Deny is Deny. If a user has deny anywhere from any group or explicit permission then they are denied that right. Go to the security -> advanced -> effective permissions on a file and see what that tells you.
JBaldridge
  • 484
  • 3
  • 10
  • 2
    `When you make a permission change the users need to logout and log back in for the changes to take effect` - That isn't technically correct. Changes to security group membership requires a new logon. Changes to NTFS permissions do not. If the users were already members of the security group in question and their access token reflected that, then changes to the NTFS permissions for that group would be effective immediately. No log out and log on is required. – joeqwerty Nov 15 '16 at 18:46
  • 2
    `In Windows Deny is Deny. If a user has deny anywhere from any group or explicit permission then they are denied that right` - As a point of clarification, an explicit Allow takes precedence over an inherited Deny. – joeqwerty Nov 15 '16 at 18:48
0

You were already introduced to the main concepts of NTFS permissions in the answer by @JBaldridge above which haven't changed much since early days on NTFS/Windows server. I would only add a few things:

  • Watch out how you access folder, locally or over the network. It the latter is the case, then you have to take into account Share permissions. You have to consider both Share and NTFS permissions: having write on NTFS level won't allow you to write data over the network when Share permission is Read only. Think about Share Permissions as a funnel which comes into play only when folder is accessed over the network.
  • In case keeping in mind to level of permissions is too much of a hassle for you then well tried approach is always grant Full Control to Authenticated Users on share level, and tailor your permissions on NTFS level only - this makes admin life a bit easier. If just checked default sharing permissions in Server 2016 and it gives Full Control to Everyone + Administrators by default.
  • Worth reiterating: Explicit deny always win, no matter how many grants/allows you add.
  • Keep in mind order of precedence to understand effective NTFS permissions permissions are evaluated in this order and evaluation stops on a first match: 1) Explicit Deny 2) Explicit Allow 3) Inherited Deny 4) Inherited Allow

And last but not least make use of Effective Access to verify what level of access specific user or group have. It's available for you in Advanced Security Settings for folder, see picture below demonstrating UI of this feature (I guess picure should give you quite good understanding of what you can do with this feature):

enter image description here

Mikhail
  • 1,295
  • 3
  • 19
  • 35
  • 2
    `Worth reiterating: Deny always win, no matter how many grants/allows you add` - That's not correct. An explicit Allow has precedence over an inherited Deny. – joeqwerty Nov 15 '16 at 20:13
  • 2
    It took me to re-read your note before getting your point. Order of processing goes from child up to to the three and it stops at first deny or if there is no such on first allow, so explicit allow on object will win over inherited one. I will edit my answer to say explicit deny always win which seems to be a bit more correct maybe? – Mikhail Nov 15 '16 at 21:12
  • Right, I just wanted to provide some clarification. Thanks. – joeqwerty Nov 15 '16 at 21:28