1

Sorry Spiceheads, I am full of NTFS questions! So here is my next issue:

I have an AD security group tied to a particular folder in my share drive. The permissions are propagating down that folder tree. This particular groups has: Read&Execute, List folder contents, Read, Write. My share level permissions are Read & Change for authenticated users. If I go into that folder and look at the permissions on the sub-folders I see the same as above. I also plugged the user’s name into the effective permissions box to ensure she was getting the access she was supposed to via her group - and she was! The trouble is none of the people in the group can create files, rename files or modify files in anyway. I.e. the user that reported said she opened the file and tried to do “Save As” and got the message “folder is read only access denied”. The other person said she was trying to create a tab in a spreadsheet. All permissions look FINE, but the only thing I see is on the general tab the folder does say “Read Only (Only applied to files in folder)”. But it also seems ALL my folders in the share are like there and no one else has complianed. Even my old share had that read only setting on the folders! What am I missing here?!?!?!?!

7 Spice ups
(Frank4811) 2

Check to see if those users are in other groups with limited access.

2 Spice ups
3

As a rule of thumb, you should assign Full Control Share-level permissions to the Authenticated Users group and use NTFS Permissions to assign the ACTUAL permissions.

3 Spice ups
4

As mentioned - checking the effective permissions on those users shows that they should have write access. So I do not think that is it. Plus, I just resctructured the security groups so I am comfortable with how it is setup that there is nothing overriding it. As for the share permissions - if it isn’t full control there - would it cause this issue and furthermore for only one group??

5

Question - After you restructured the groups, did you have those users log off and back on again after doing so?

6

Yup - and even had them do it again for good measure because this just isn’t making sense to me.

7

I don’t apply full permissions…

that only allows you give those users rights to manage permissions… I NEVER do that…

I allow change on the share level though

I’m more interested if its a similar issue to what I’m having trouble with lately…

basically take one of the xls files that you’re having an issue with and give some random user dedicated rights to it and see if that helps…

(your issue seems different like you do have a more restrictive deny hiding somewhere though)

1 Spice up
8

I still recommend setting those Share permissions to Full Control. This will save you a lot of troubleshooting headaches. Let NTFS control the actual access to the folder.

9

I def. don’t have any deny permissions set up. As mentioned this is a new share I just created and all new permissions I just built.granted. I suppose I can try granting permissions on the file level for testing. I also didn’t give full permissions for the same reason you stated, but not sure what issues that may cause…hmmm

10

on the share permission uncheck READ

Only have Change permission

AVI Correct me if wrong

Share permissions - Most Restrict Applies

NTFS Permissions - Least restrictive

This would makes sense that effective displays correct but still only have read-only - share level issue

AVI - Correct Full would correct but also unchecking READ also resolves

(not sure yet though - just checked a few of mine and still have read checked as well)

11

Maybe just one group has share permission read and not change?

that would make more sense… READ Should be there I was wrong…

would be multiple groups

Group A Read

Group B Change+Read

Effective of user in both Groups - read only (I think)

12

This article states that to save an Excel file you need to have modify permissions WITH delete access as well. I also heard you need modify/delete the rename files as well. This seems insane to me. Thoughts?

13

Modify includes delete rights…

Excel / Word most office formats would require this…

The temp file is the is tricky part and why there is the issue with delete (but needs to be on the directory)

14

Correct :slight_smile: Isn’t this fun! lol

15

Turns out after talking with many people (and big props to AVI-NetworkGuy for some offline help). That MS just stinks in the fact that you have to give modify if people are going to be editing Excel/Word/etc. as the temp file needs to be created and deleted while working on the file. Thanks all for your help working through this on me.

1 Spice up
16

Damned temp files! So annoying…

1 Spice up