Changing ntfs permissions

This is a basic question.
I have a windows 2012 server standard with a windows 8 client.On the server is a share AfdelingProductie. This share is on the client mapped to the drive S: for the user Flo_Fli. The user creates a document test.txt in the drive.I file explorer on the client
I open properties of the document. Then i choose tab security, button advanced. There I want to change the ntfs permissions by disabling inheritance, removing group and adding a group with adapting the permissions. When I click apply: I get the message:access
denied. Is it normal that I cannot change the ntfs permissions as owner with full control on the client?

Hi,
Please give the everyone group full control for share permission and then to change the NTFS permission.
Regards.
Vivian Wang

Similar Messages

Can't apply NTFS permissions - Access denied

When I am trying to change NTFS permissions on shared folder I get the error:
An error occurred while applying security information to:
\\fileserver2\etc
Failed to enumerate objects in the container. Access is denied.
fileserver2 is Server 2012R2.
Folder "etc" is shared with full control permissions to
everyone.
My user has "Full control" NTFS permissions on that folder.
P.S. If I login to fileserver2 via Remote desktop, I am able to change permissions for that folder, but not when doing same action via share.

Hi Aurimas,
Based on my test , if you want to "everyone" to change NTFS permission of root file share you need to change "everyone" to be the owner of the share folder .
Best Regards
Elton Ji
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.
Hello,
I do not want "everyone" to be able to change NTFS permissions, I want those with "Full Control" to be able to change NTFS permissions as currently they can't.

Ntfs permissions on forest trusted share

We have a two way forest trust. Consider this example:
Forest A has:
Domain Controller A
Server A
Forest B has:
Domain Controller B
Server B
\\shareB (on Server B)
I am a domain admin on Forest A, and my account has been given full permissions to Share B. We have a two way forest trust, and have firewalled everything except communication between Domain Controllers A and B.
The issue:
If I log on to Server A, I am able to open \\shareB, but if I attempt to add/change ntfs permissions, I only see 'server B' when I click the 'Locations' button (I do not see either domain).
If we allow on our firewall port 445 between Server A and Domain Controller B, it works.
Is this working as designed? Or is there a way to keep the firewall up and retain this functionality?
Thanks,
Jaime

Hi Jaime,
>If I log on to Server A, I am able to open \\shareB, but if I attempt to add/change ntfs permissions, I only see 'server B' when I click the 'Locations' button (I do not see either domain).
How did you add/change NTFS permissions? In addition, would you please post a screenshot of the Locations?
>If we allow on our firewall port 445 between Server A and Domain Controller B, it works.
Port 445 has to be open, because User and Computer Authentication, Trusts require it to be.
More information for you:
Active Directory and Active Directory Domain Services Port Requirements
http://technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx
Best Regards,
Amy

Reading NTFS permissions and changing them with PowerShell

Hi,
I have a large folder structure which contains the shares for several sites. I've been asked to change the permissions for a group on each of these folders from 'full control' to 'read and execute' on the top level only. My problem is that the
name of the group to change is different on each folder. They follow the same naming convention however which I've attempted to show in the example below.
Folder1 has a group named FOL1-AdminUsers which has full control, there are several other administrative AD groups with permissions to the folder which must remain the same. Similarly there is a Folder2 which has a group named FOL2-AdminUsers
which needs to be changed and so on.
The part of the script I'm having trouble with is reading the existing permissions from a specific folder and searching for the group I need to change. Everything else has been fairly straight forward but I've just become completely stuck
on this. I'd really appreciate any help anybody could give me or if you could point me in the right direction for further assistance.
Many thanks,
Gary.

Hi Gary,
you can read access permissions from a folder by using the Get-Acl cmdlet (Get-Acl "C:\ExampleFolder"). This will return an
DirectorySecurity object. This comes with an Access CodeProperty that will return all permissions on the folder:
$Acl = Get-Acl "C:\ExampleFolder"
$Acl.Access
It has many useful methods as well, so check out its members:
$Acl | Get-Member
Finally, there are useful tools for manipulating Acls, notably the official Set-Acl cmdlet or Rohn's AccessControl Module (Thanks Rohn, it's awesome) in the Gallery.
If the module is a bit complex for you, there are some simple functions - shameless advertisement incoming - you could instead use: New-AccessRule and
Add-AccessRule.
Cheers,
Fred
There's no place like 127.0.0.1
Thanks for the compliment!
Gary, Rhys and Fred already mentioned that the info you're looking for is in the Access property when you use the built-in Get-Acl cmdlet. You could also use the Get-AccessControlEntry function from
the module Fred mentioned:
# List all ACEs for a single folder
Get-AccessControlEntry C:\Folder
# List all ACEs for specific principals (this example searches for two):
Get-AccessControlEntry C:\Folder -Principal FOL*AdminUsers, AnotherUserNameHere
# List ACEs for all subfolders (uses PSv3 syntax):
dir C:\Folder -Directory -Recurse | Get-AccessControlEntry

Can't rename a single file to autorun.inf even all ntfs permissions are correct

I have this odd problem:
Logged in as Domin Administrator I couldn't rename or open for editing an existing file "autorun.inf" even though all the ntfs permissions were correct. Every other files in the same directory (mainly .swf, .docx, .js and .htm files)
are both editable and can be renamed.
When I deleted the file "autorun.inf" from the folder and tried to create a new one with the same name, OS (Windows Server 2008 R2) notifies me that I "need permission to perform this action". Furthermore OS notifies me that "You
require special permission from Administrators to make changes to this file". Neither can I copy a file named "autorun.inf" from another location to this folder. This is in spite of being logged in as Domain Admin.
In short: I can't create a file called autorun.inf in a folder!
Could there be some kind of extra locking concerning files named autorun.inf i.e. some protective mechanism in this particular folder's permissions or SRV2008R2 itself that I've missed. All the other folders allow me to create whatever files i like
into them.
I would very much appreciate if anybody can help me with this.

Yes, by default that will block any access to autorun.ini files. We use the same, so the issue sounded familiar, and of that I asked specificly to that :)
Best Regards,
Jesper Vindum, Denmark
Systems Administrator
Help the forum: Monitor(alert) your threads and vote helpful replies or mark them as answer, if it helps solving your problem.

Unexpected NTFS permissions behavior

I am administering a home server running Windows 2008 R2 (accessed by several Windows 8.1 clients) and have run into an NTFS permissions issue I do not understand.
On this server there is a S drive that contains all the online storage for our network.
The structure of the S drive looks like this:
Files
Public
    VariousPublicFolders
Private
    Person1
      Person1sStuff
    Person2
      Person1sStuff
Temp
Before any security modifications were made, the root of the S drive had the following permissions:
SYSTEM : Full Control
Administrators : Full Control
Users : Read and Execute
Also, all the above folders on this drive are owned by the Administrators group.
Then I started changing permissions in order to satisfy my security requirements.
For example, I disinherited permissions on Temp and allowed "Everyone" Full Control there.
That works fine.
What doesn't work fine is the permissions I am trying to set on the personal folders under the Private tree.
I want to make sure no one else (other than administrators) has access to anyone's personal data (the data in the Person1, Person2, etc folders).
So I disinherted permissions on each of those folders and then explicity set the following:
SYSTEM : Full Control
Administrators : Full Control
PersonX : Full Control
This, I thought should work beautifully.
I thought it should give each person full control of what happens in their personal folder, and also allow administrators and the system to get in there.
But it is giving people in the Administrators group problems.
I have a user called Custodian which is part of the Administrators group, and I use this user to do administrative tasks.
As Custodian, when I try to access someone's personal folder in Explorer I am greeted with a message that says "You don't currently have permission to access this folder."
Whaaaaat?
I am offered "Click continue to permanently get access to this folder."
If I say YES then Custodian is explicitly added to the folder ACL, and I can proceed to access the files there.
But I don't want this.
Custodian is already an Administrator, and Administrators already have full control of the folder. Why should I even be prompted, and even worse, have my user unnecessarily added to the ACL?
This is bad bad bad.
I think what is going on is that UAC is coming into play. I read somewhere that Administrators normally do not use their administrative token until they hit something that requires it, then UAC kicks in and asks to elevate them. This would be
fine if it happened. I guess I wouldn't mind having to click OK to enter a folder that requires admin access. But this is not what is happening. I am just blanket denied until I explicitly add the Custodian account to the ACL.
Can someone explain why an admin user is denied access to a folder having full control given to admins? What is going on here?
Can someone suggest a way to rig permissions so that my admin user doesn't have to be added explicity?
I just want to be able to browse and alter the entire drive with ANY administrative user without being bothered to alter permissions. I don't even mind being prompted for elevation, although honestly I'd prefer not to have that happen either.

Thank you, Milos, for taking the time to look at this.
RE: Making the post shorter, I'm not sure I could. It's not an easy problem to state, and I tried to do so in as few words as possible, any less and I would be leaving out critical info.
Here are your questions, answered.
(2) Yes, I am using a workgroup.
(3) An example calcs output
S:\Files\Private\Scott DATABANK\Scott:(OI)(CI)F
BUILTIN\Administrators:(OI)(CI)F
NT AUTHORITY\SYSTEM:(OI)(CI)F
(4) The share permissions are full, yes, but this is immaterial. I suffer the problem accessing the files locally/directly on the server. I probably shouldn't have mentioned anything about the share. It's just that the problem came to light
while I WAS accessing the files through the share, but then I tried locally and still had the problem.
I am unsure of what you mean in (5) (6) (7). Could you elaborate?

Defining NTFS Permissions for High Volume Security

The default NTFS file permissions for the boot volume in Windows 8.1 appear to give Modify access to "Authenticated Users". That is really permissive. I have a lot of folders I do not want anyone not authenticated as Administrator
to touch. Of course I could change every folder manually and test for side effects, but I am hoping someone has already tested this and has published a document. I am looking for a detailed description of how to secure the volume so that ordinary
users cannot modify attributes, filenames, or data for most files on the volume.
Will

Ronald, thanks for your reply. Now we are talking the right topic.
1) How did you modify the root permissions? One way to do that might be to remove Modify and Create authority for the "Authenticated Users" entity and replace that with just Read & Execute.
2) I understand that Microsoft tightened things to prevent normal users from having modify access inside subfolders. This works fine for well behaved applications that use things like the "Program Files" subfolder. Unfortunately, many
applications are badly behaved and put themselves directly under the root of the boot volume. AMD for example puts its video drivers in c:\amd by default. Since that folder inherits from the root, and the root gives permissive access to
users to create and modify files, now many sensitive DLLs in this install folder could be easily modified by any user.
One of the worst viruses I ever had was a denial of service virus that acted simply by hiding every single file on your file system. We had locked down NTFS permissions but had forgotten to lock down file attributes. It took forever to recover
from that.
So, bottom line, I like to run as tight a file security as possible, and I like to stay logged in as a normal user and greatly restrict what normal users can change.
Microsoft definitely tightened things up in Windows 8 and that's great.
Will

Renaming folder resets NTFS permissions

Hi
I have installed a new file server, running Server 2012 R2. I have created a shared folder and set the NTFS permissions. I then renamed the folder and noticed that the NTFS permissions had ben removed and reset.
I have never seen this behavior before, and I find it a bit worrying???
Lasse
/Lasse

Hi Amy
The steps I initially did:
1. Create folder in the root of D:
2. Disabled inheritance
3. Added the necessary permissions (The user I use is a domain admin, and is also added)
4. Shared the folder to Everyone with full control
5. Right click on the shared folder and selected rename and gave the folder a different name
6. Vupti dupti, the permissions has changed to the following:
SYSTEM
MY USERNAME
Administrators (LocalServer\Administrators)
I have just done the same thing on a different server, and it's the exact same behavior, both servers running Server 2012 R2.
I have also tested it on a Server 2008 R2, and it gives me the same warning as you and if I press continue the folder is renamed and the permissions has NOT been changed.
So it seems to be a Server 2012 R2 "issue".
/Lasse

Unable to set NTFS permissions on share using PowerShell. The user shows up with no rights checked off.

I am having a little problem here with setting NTFS permissions via PowerShell.
Basically I am able to make a new directory on the share, and assign a user NTFS permissions however it just assigns the select user without any permissions set.
$username = "test.user"
$directory = "\\testlab-sv01\Share\newfolder"
New-Item -Path $directory -ItemType Directory
$colRights = [System.Security.AccessControl.FileSystemRights]"FullControl"
$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::InheritOnly
$objType =[System.Security.AccessControl.AccessControlType]::Allow
$objUser = New-Object System.Security.Principal.NTAccount("$username")
$objACE = New-Object System.Security.AccessControl.FileSystemAccessRule($objUser, $colRights, $InheritanceFlag, $PropagationFlag, $objType)
$objACL = Get-ACL $directory
$objACL.AddAccessRule($objACE)
Set-ACL $directory $objACL
A side question, why isn't this native in Powershell? Is it for security reasons? I expected there to be a cmdlet for it.
Thanks.
Kyle

When you say there are no permissions, do mean that the ACL Editor is showing 'Special permissions' and none of the other boxes are checked?
Try changing the inheritance and propagation flags to this:
$InheritanceFlag = [System.Security.AccessControl.InheritanceFlags] "ContainerInherit, ObjectInherit"
$PropagationFlag = [System.Security.AccessControl.PropagationFlags]::None
That sets the ACE to apply to the folder (InheritOnly propagation flag isn't set) , subfolders (ContainerInherit inheritance flag is set), and files (ObjectInherit inheritance flag is set), which is necessary for the ACE to not be considered 'special' in
the ACL Editor.
Awesome. Thanks. That did work.
And yes I did mean that it was showing special permissions with nothing checked.
Kyle

Cisco NSS4000 NTFS Permissions Issue

Hi guys,
I have a Cisco NSS4000 4-Bay Gigabit Network Storage System with a RAID5 array and a 2.75TB volume. I have also created a CIFS share, configured the NAS on the domain and given all users full access to the share. My issue is that the subfolders under inside the volume don’t inherit the NTFS permissions from the parent folders. No matter how many times I check the “Allow inheritable permissions from the parent…” option, it always seems to get unchecked. As a result of that, any new files the users create will only be editable by the person who created it, until I manually change the permissions. I don’t see any errors reported on my DC or the NAS logs.
Any help or guidance would be highly appreciated.

Nathan Guinle wrote:
What extra software do I need to install?
you don't need any extra software to be able to read NTFS drives, you only need it to be able to write to them but that's not what you are trying to do.
You asked, "where exactly are you trying to move the files?"
I am trying to move them anywhere on my mac.
I created an empty folder in my documents to be exact.
I have tried moving files/folders one at a time but I keep getting that permissions error thing.
This is just crazy..... I can't believe I can't move my files from my windows to my mac....!!
How do other people (switchers) do this?
other people don't have this problem.
what you see is not normal. NTFS drives are readable by OS X and you should normally be able to copy anything you want from that drive. something is wrong with your drive but since it's NTFS there is not much you can do from OS X. try hooking up the drive to windows and repairing it from windows with [chkdisk|http://support.microsoft.com/kb/315265].

Making NTFS permissions read/write without ability to create/delete folders

Out at one of our job sites we have a server running Windows Server 2012 R2 that's got a file share accessible to our onsite people. Our project managers have devised a very strict folder structure for this file share, and for auditing purposes they want
to stick as close to this structure as possible.
Therefore, although people onsite must have read/write access to create, modify and delete files, they do not want them to be able to create or delete folders. They want them to use the existing folders and not tuck stuff away into folders that no one knows
exists except the person who created them.
The closest way I've found to do this is to deselect the advanced permissions 'Create folders / append data' and 'Delete subfolders and files.' This has a few side effects however, the most noticeable being that due to not being able to append data to files,
certain files (such as CAD drawings) can't be edited by anyone except the person who created them.
Is there a way using just NTFS permissions to accomplish what the project managers want? And if not, are there any useful third-party utilities that will help us do this?
Thanks in advance for any assistance.

Hi,
I'm not much familiar with AutoCAD- what's the exact behavior which is stopped by the restricted folder permission?
For example, if AutoCAD will create a folder in editing, we will not have a solution as users needed to create folders so that AutoCAD could run properly.
And if AutoCAD works like Office files, that create a temp file for editing, this will be the solution:
1. Give Domain Admins - Full Control - This folder, subfolders and files.
This is to allow all admin could access and edit all data.
2. Give SpecificUsers group (a group contain all normal users) - Full Control without "Change permissions" and "Take Ownership" -
Files Only.
This is to give that group most permissions to create, edit and delete files but not Folders.
3. Give SpecificUsers group another permission:
Traverse folder
List FOlder
Read Attributes
Read extended attributes
Create files - this is important. Without this permission you will not able to save Office files.
Read permissions.
Give above permissions to "This Folder, subfolders and files".
This is to allow users to access all subfolders.
If you have any feedback on our support, please send to [email protected]

What share and NTFS permissions must I give users to deploy software through SCCM?

What share and NTFS permissions must I give users to deploy software through SCCM? I have one folder with all of the applications and would like to know.
Thanks
James A+, Network+, MCP

That still doesn't help. We're not prying, we're trying to help but we honestly have no idea what you are talking about. The more and better details that you can provide, the better we can help.
"Because I want to know" adds no value and does not help us help you. We need technical details -- we can't see what you are seeing and we can't read your mind.
And, you didn't really answer any of my questions.
I'll take another wild-guess though: If you are talking about the source file locations referenced within packages and applications, users do not access those. The computer account for the systems hosting the SMS Provider needs read access to the location(s)
specified. Yes, this means both NTFS and share permissions assuming they are being referenced via a UNC.
Finally, there is no service account. If you've changed the account that the SMS_EXECUTIVE is running under, you're are now in a completely unsupported state that will have many issues. If instead you are talking about the Network Access Account, that is
*not* a service account and is *not* used to access content source files.
Once again though, we're simply guessing because no one has any idea what you're doing. Please provide actual, technical details.
Jason | http://blog.configmgrftw.com | @jasonsandys

NTFS Permissions - Need Read, List, Delete not Write or Modify

I don't think you can have delete, but not write or modify.

I'm setting up Network printing to a shared folder on a server. I want the users to be able to browse and see the files the printer's scan there and delete them when moved off. I don't want the folder to be used for long term storage so I don't want write or modify on it (ie user opens a scaned file makes changes and just clicks save). How do I go about setting this up with NTFS permissions?
This topic first appeared in the Spiceworks Community

System Folder errors after I changed all permissions on HD to read & write

Hi,
Two things may have caused probs on my new 2010 iMac (Snow Leopard), and Applecare is shut so I would really appreciate some help as I have urgent work.
1) INCORRECT PERMISSIONS
I have been stupid. I clicked on Macintosh HD and changed all permissions to read & write because I wanted to be sure I could open and edit all documents on other computers.
I ran Disk Utility Repair Permissions from the install disc, but I am still getting system error messages, and my HP printer won't work.
The first message, in Repair Permissions, said: Warning: SUID file System/Library/Cores has been modified and will not be repaired. I have read a support doc on this which says no need to worry but I don't like it and would like to fix this.
More importantly, my HP printer won't work, displays error beside the document in print dialogue box.
Deleting the printer and readding it didn't work, so I downloaded new drivers and tried to install them, which is when I got the second system error message: System extension System/Library/Extensions/BJUSBLoad.kext was installed improperly and cannot be used. Please try reinstalling it or contact product's vendor for an update.
I checked the permissions on the file and they were still wrong despite Repair Permissions, allowing everyone to read & write. So I have now clicked on the entire System folder and changed the permissions to: System read & write, admin read only, everyone read only.
Will this fix it or do I need to do something else, such as check ownership, to make sure all permissions on the computer are now correct?
2) MEMORY STICK SHUT DOWN MY IMAC
Additionally (though I don't think this had anything to do with my problems), I inserted a Sandisk USB memory stick the other day and it immediately shut down the computer. When I inserted it into my Macbook it initially rejected it and gave me a message saying the device wanted too much power so it had ejected it to prevent damage to my computer. When I tried again it was OK. I totally reformatted the stick in case there was something harmful on it, but should I now bin the stick as faulty? Scared to use it again.
3) IS IT BEST TO REINSTALL ENTIRE SOFTWARE?
If I do a reinstall of all the software from the install disc, will it wipe out all my data, such as Mail, documents, bookmarks and other apps?
I would back-up, but if I try and back up files on my external drive it will automatically do a Time Machine back-up and I don't want to do that in case it backs-up all the corrupted files. Otherwise, I wouldn't mind starting again just to be sure all is well.
Expert advice would be very much appreciated.
Thank you
Sarah

Oh, silly really. I was in a hurry and working on docs that I needed to take to the office and open on another computer there.
But when I checked the permissions on the doc it said I could read & write but everyone else was read only.
I thought if I opened it on another machine I'd be stuck with read only access and not be able to work on there. I think I couldn't change it, so I thought to avoid any future problems like that I would change everything on machine!
Yikes. Won't do that again
Sarah

How do I stop DW CS6 randomly changing file permissions via FTP?

How do I stop Dreamweaver CS6 12.0.1.5842 randomly changing file permissions when it uploads files to my web server via FTP.
I can no longer trust Dreamweaver to upload websites correctly as it changes permissions on some files which then deny the server access to the file which in turn makes the webpage unreachable/return a 403 error.
This is driving me insane.
I'm using an early 2011 Macbook Pro 10.7.5.

Hi,
I'm having this problem too. Has Adobe fixed the issue yet? This appears to be an Adobe problem, not all the web hosts out there. CS6 is ramdomly (meaning: not every time) changing permissions on files uploaded with it and is not usable for web work until this problem is fixed by Adobe or a solution is provided. If I wanted to use a separate FTP program I would not have recommended that my employer buy multiple Adobe CS6 product licenses. One of the primary appeals of DW is the integration of FTP into the workflow.
I am using a destop iMac2.8 GHz Intel Core 2 Duo, 4 gigs of 800 MHz DDR2 SDRAM.
OSX 10.7.5
I am using DW Version 12 Build: 5808
Dreamweaver CS4 that I was using until this new purchase was working just fine. No file permisssion changes. I am being forced to go back to using it until Adobe posts a fix for this.
I should ask while I'm here: has anyone found a solution for this yet?
Thanks,
-c-

Changing ntfs permissions

Similar Messages

Maybe you are looking for