1

I have a shared folder and a security group called ‘Staff’ containing all the staff members.
I want some of the users in the ‘Staff group’ to be Write and some to be Read Only but I can’t seem to seperate them.
I’ve tried to create ‘Staff Write’ group and put just some of the members of the ‘Staff’ group into it, but it gets overriden by the Read permission on the ‘Staff’ group.
How can I get around this?

3 Spice ups
2

So have you added the group “Staff write” to the share permissions with write/full-access?
Then to test, logoff and logon as a user in ‘staff write’ and try to access?
It should give write access - so long as the ntfs permissions allow.

First all permissions of a type (ntfs/share) are cumulative and the least restrictive wins - so in this case it should be ‘write’
Then the share and ntfs permissions are combined and the MOST restrictive wins.

So if the share allows ‘staff write’ to write - but the NTFS permissions (actual file/folder permisions) are for example read only - then read only will be the result.

3

Groups are not really heirichal, you should probably make 2 distinct groups, with users in either one or the other. Things get really messy and complicated if you try to overlay one groups members into another.

Also when testing watch out for caching, the machines do not update group membership very fast…

4

In the end i created two new groups because as you say it was really complicating things trying to over lap them.
All working now
Many thanks

1 Spice up
5

Add each group to both the share and NTFS permissions with the required access. Avoid using deny rules, because the deny will override allow.