Group Folder -- Permissions Get Lost/Denied

We have a small LAN with a single group folder on an AFP network mount. The protocol is set to "inherent permissions" and I've promulgated this to the folder at least once. The owner is "admin" and the group is set to the short name of my workgroup. All (including "everyone") have permission to read/write. Every user is in the group. The acl list is empty, and the network mount is set to "use for: user home directories" (the latter because there is no option to select 'use for group folder.'
The folder is set to mount at login. (Users login at login, tho their homes are local.) All works fine, BUT after a while, the permissions to use the folder and its contents gets lost and the user is denied access.
A logout usually restores the right to use the folder, but this is driving me/my users crazy. Any aid much appreciated.

i'm seeing something very similar but not with a group folder. my users are constantly loosing their permissions on files within sharepoints that they should have access to. they have to log out of the server and log back in to restore the correct permissions.
is anybody else seeing this? it's becoming a huge problem and happens daily now.

Similar Messages

Why don't permissions get set correctly when add to Public folder?

When I add files to my Public folder I expect the permissions to match my public folder. In particular, they should be readable by 'others'.
Often the permissions don't update. The result is that other users can't read files in my public folder. I have to manually apply the default Public Folder permissions to all enclosed files.
Is this only a problem on my machine? How would Public Folders work if they didn't update permissions when files are added to them?
BTW, I run as a regular non-admin user. I enter my admin un/pw only as needed. It's a good practice.
PS. I've repaired permissions, but that's a superstition anyway.

The "Public" folder in OS X is just a regular folder - it won't modify anything added to it. In the context of file sharing, the sharing of folders can be configured so that items copied from one computer to another will have their permissions modified, but this only applies to file sharing, and by default, only to a folder with "Drop Box" permissions (ie. "write only").
Regarding "read" access of files, in general (there are exceptions) files or folders created by a user are, by default, created with permissions such that everyone (user, group, other) gets at least "read" access - it shouldn't be necessary to change their permissions before making them available to others via the "Public" folder. If items don't have at least "read only" access, this suggests that the default permissions have been set to something more restrictive (possibly via a 'NSUmask' key added to the ".GlobalPreferences.plist" file). Or perhaps the files are coming from some other source. So this suggests that either the problem concerns a non-default configuration or a special case, but unfortunately there isn't enough information in the post to comment on what the problem might be.

I keep getting this error in Dreamweaver when I am trying to upload my website? Can you tell me what I am doing wrong? here is the error message: /html - error occurred - Unable to create remote folder /html. Access denied. The file may not exist, or

I keep getting this error in Dreamweaver when I am trying to upload my website? Can you tell me what I am doing wrong? here is the error message: /html - error occurred - Unable to create remote folder /html. Access denied. The file may not exist, or there could be a permission problem. Make sure you have proper authorization on the server and the server is properly configured. File activity incomplete. 1 file(s) or folder(s) were not completed. Files with errors: 1 /html

Nobody can tell you anything without knowing exact site and server specs, but I would suspect that naming the folder "html" wasn't the brightest of ideas, since that's usually a default (invisible) folder name existing somewhere on the server and the user not having privileges to overwrite it.
Mylenium

What should default permissions be of the Groups folder be?

While trying to sort out our Group shared folders permissions problems I might have changed the permissions of the Group folder (/Volumes/Server/Groups) in Server Admin.
Can anyone tell me what the default permissions for that folder should be?

I had a similar problem:
<http://discussions.apple.com/thread.jspa?messageID=5876784#5876784>
and Gerrit came to the rescue! Wonder if you migrated from Tiger and if so then the above thread might have some answers for you. Seems like the standard Group ID (gid) changed from Tiger to Leopard and has wreaked havoc on file sharing. I was able to remedy my situation (so far - still not thoroughly tested) by changing the gid of all files back to 20...which matches "staff" on the clients. This is still confusing and Apple's documentation is half-baked regarding this as far as I'm concerned.

[Solved] How to restore lost home folder permissions

I recently moved a shared folder with a few hundred home folders in it to fill up drive space. After I moved it i made sure that it was reshared exactly the same way only to discover that each users full rights, originally granted by active directory, were
missing. I searched the internet for hours looking for a solution and never found one, so when I created my own i decided to share my method.
We use a simple structure. Use AD to create the home folders (\\servername\share\%username%) which gives the user full control of their folder, then enable access based enumeration so they can only see their
own folder. What i did was move the already created folders to a temporary location, then select all users in AD and recreate the home folders using the method above. Now I have all of the correct folder/permissions, they're just empty. Next I copy the old
folders back, and merge them with the new folders. What I end up with is essentially all of the original files in newly created folders with the correct permissions.
Hope this can save someone the hours I wasted in research.

Thanks JaMere! That was helpful. I was about to restore permissions from backup, but instead tried your method out of curiosity. Worked like a champ!

Why does my Applications Folder permissions not include me?

Added after posting (please still answer the original ?s if you have time): I just read the post about a similar situation in 2009. So, if I'm the only admin in the admin group, and the admin group has Read & Write access, why do I have to enter my password to make changes and/or why do I get error messages about lack of permissions?
OK. Got a new MacBook Pro. Ported over my stuff from the old one that died a horrible death (the battery was recognized as being installed, but no charge ability, lost all interactions with the internal hard drive and short term memory... worked after I removed the internal hard drive and started up via USB connection... short term memory stayed dead). Well, I'm getting error messages on my new MBP saying I do not have permissions to make changes to some documents and apps (kind of like my previous MBP just before it died so I'm a bit uncomfortable about that). I repaired permissions, no joy. I then changed the Document folder's permissions to make me sole Read & Write access, all others no access. I then changed the Apps folder to just add me with Read & Write access, no changes to existing access (system & admin Read & Write, everyone Read only). I stopped getting the error messages (knock-on-wood!). I just ran permissions repair and my "custom access" has been removed from the Apps folder. I'm fully expecting error messages and want to know why that access is set that way?
Also, my Apps are at the root level, not in my Home folder... is that why? Should I move my apps to my home folder? Nobody else is ever going to use this computer.
Thanks
BTW: please do not answer that I shouldn't change permissions. I am aware of that admonition. However, I bet the admonitor is not getting no-permissions error messages every day...
Message was edited by: John Gruver (OP) to correct spelling and add another/follow-up question

Your application folder is owned by the system. You do not need your user on the application folder. Only 3rd party applications installed by you will possibly have your user id in it.
More likely the problems you had were due to your home folder permissions. If you want to reset your home folder to default permissions, follow this:
Resetting the home folder permissions can resolve problems with your user account on your Mac.
Turn on the Mac whilst holding down cmd + R. You can let go once you see a spinning dial. You will then see the ”Mac OS X Utilities” screen.
On the top menu, click Utilities, then click Terminal.
Type resetpassword and press Enter.
Click on your main hard drive.
In the dropdown box under “Select the user account” make sure to select your username.
Underneath where it says “Reset Home Directory Permissions and ACLs”, click the Reset button.
Press cmd + Q to quit the Reset Password application.
Press cmd + Q again to quit the Terminal.
Press cmd + Q one more time and click Restart.
Click Mac OS X Utilities in the top left of the screen and click the Restart button.

Sync Errors - What Are the Correct Folder Permissions?

I've been having problems recently on the PB getting it to successfully sync.
Decided to open the log using Console and see what was happening - all sorts of errors! One seems to relate to permissions, the other to a possible problem at .Mac
It had attempted to create a folder 'Syndication' under '~/Library/Application Support' and couldn't. What should the group be to get this to work properly - clearly it isn't 'staff'!
In the other one it seems that a http 404 error occurs (not found) when trying to retrieve keychains from .Mac - going to keep an eye on this.
Cheers
Powermac G5 DP 2.3 GHz Mac OS X (10.4.4) 4.5 GByte RAM

.Mac sync got a lot of problems this week and Apple has disabled it for now. Check www.mac.com and I think you should follow .Mac forum instead of iSync one as this is a .Mac problem (iSync does not handle .Mac sync). People are discussing the issues you experience there.

Question about folder permissions

I have set up separate user accounts for myself (as administrator) and my wife and four kids (a total of six user accounts). After having problems in iTunes and iPhoto with messages regarding "locked disk, or no access" I created a group called "family" which includes all the user accounts plus admin and root. I then changed the folder permissions for all the user subfolders (and their subfolders) to be as follows:
owner = Eric, access = read & write
group = family, access = read & write
others = read only
(Note that the folder permissions for the Users folder itself are the original ones, i.e., owner = system, access = read & write; group = admin, access = read & write; others = read only.)
Are the changes I made unnecessary or incorrect? An alternative scheme that was recommended by someone in a thread pertaining to the iTunes "locked disk" issue was the following for a given user (presumably someone other than the administrator):
owner = (user name), access = read & write
group = (user name), access = read only
others = read only
Any comments/advice will be welcome.

Hi Eric55,
I want to suggest two things:
You yourself should use a non-admin account for daily
work. An administrator should administrate, and
should not write a letter. This would reduce risks of
malicious software doing bad things to your whole
system (since it would have your admin rights) and
you yourself doing bad things without noticing (like
deleting important files accidentically just because
you can do so without warning).
Many thanks for your very helpful reply. I can see the wisdom of what you're suggesting. So, should I just create another account, e.g., called "Eric2," that I use for routine work, leaving the "Eric" account that has admin rights alone except when needed for admin tasks?
Regarding your question with folder permission: There
is a folder named "Shared" that should hold all the
files that everyone needs to have access to. The
important bit is that the files in it must also be
available to everyone.
I had understood from the book I bought ("Mac OS X, The Missing Manual, Tiger Edition," by David Pogue) that all users have access to the Shared folder and its contents. In fact, this is how I got into this whole issue of folder permissions. Pogue's book suggests putting music (MP3) files into the Shared folder (rather than leaving them in each user's Music folder) so that all users can share them in iTunes (after switching the iTunes music folder location to the Shared. . . folder). I did this, but then my son, working from within his user account, was unable to copy the contents of a music CD into the Shared folder. That got me started on what seems to have been a misguided effort to expand folder permissions so that he (and other users) would have read & write access to the Shared folder, not just read only access.
But once I did that, the kids starting having problems with iTunes and iPhoto from their user accounts. For example, a common problem was that when trying to open iTunes they would get an error message saying that iTunes was on a locked disk or they didn't have permission to access the folder. This didn't make sense, since I thought I'd expanded their access rights sufficiently by putting them in a "family" group and giving that group R&W access. So at that point, I concluded that I didn't understand permissions well enough!
And for this a common group is
alright, but Mac OS does not do this automatically;
all files copied there must be changed manually (or
by a folder action Apple Script, if you know how to
do this) to this group and have the proper rights
set.
That's what I thought I'd done with my "family" group, but that seems to have created more problems that it solved.
BTW, I would not put admin or root users in this
common group, again out of caution.
OK, makes sense.
And user folders
should belong to users, not to everyone. Just my
thinking ...
Again, what I was basically trying to accomplish was to have all the music files in the Shared folder, but at the same time make it possible for individual users to add music to the Shared folder. Maybe you have some suggestions for how to do that, and for how to revise the permissions I set up, e.g., to put them back to how they were before. If so, many thanks in advance!
--Eric

2012 R2 DFS-R stops replicating content between members when folder permissions changed

Hello,
Since upgrading our DFS member servers (one is a physical DC, other is a VM dedicated to DFS role only) to 2012 R2 I keep getting caught in a weird replication problem. I finally found out when the problem starts, it's the change of Folder access permissions,
e.g. removing or adding a user account or group and I don't get it why exactly contents of such folder end up completely mismatched between DFS member servers.
To start from beginning, an example
Both DFS servers have a dedicated NTFS volume Y: with only 1 folder in it named Folder1 which is shared and added as Folder target on both DFS member servers. Replication group exists for that Folder1 and data is in perfect sync. New/altered content is properly
replicated to other members server in no time (<1s), everything works perfectly well.
Now, Folder 1 contains a dozen sub-folders with permission inheritance enabled, data de-duplication is enabled as well as FSRM file screening to avoid temporary files, thumbs.db and other junk of that sort. Let's say Subfolder1 requires admin to change permissions
so certain group of users get a read-only access to files stored inside while others can retain modification permission to put new files or so.
The moment I do that change it triggers a problem with DFS-R and I end up with proper copy of that sub-folder on DFS1 (physical server acting as DC) and maybe around 5-10% of content on DFS2 ... why is that so that a simple permission change operation breaks
the DFS-R every time? When that happens the DFS2 never gets those missing files, just like it didn't know it should have those.
DFS Health Report shows file count mismatch and regular File Sharing Violations from some opened files, but there is no mention of why the darn DFS2 is missing 90% of files in certain sub-folders ... it's so annoying ...
I found only 1 workaround for this problem so far, that is to manually pull out all files from affected sub-folder and get them out of shared Folder1 (simple cut and paste to new temporary folder on same volume works) on DFS1, so DFS2 clears that problematic
Subfolder1, and then manually dropping the files back in place on DFS1, later all is good on both servers ... pretty weird if you ask me.
I don't recall seeing this problem on "slow" 2008 R2 DFS-R ... Also I tested if maybe FSRM screening rules or data de-duplication has anything to do with problem, but they don't.
Does anybody else see this behavior between 2012 R2 DFS members?

interesting, seems the problem was with primary DFS member (the physical DC), it was simply not sending out updates to the partner, it was like that with all 2-way connections (all working one way from "secondary" to "primary" only).
I googled a bit a found that backups (we have nightly on either member server) trigger a pause state on replication, officially it's harmless, but what if it doesn't always automatically resume?
for now, from DFS Manager I removed all replication connections and checked if DFS2 still awaits some pending updates (sort of stuck on that), but it still did, so I had to disable its membership in all replication groups, that cleared that problem out.
After that I re-enabled its membership and re-created all 2-way replications connections, of course it triggered complete refresh of all replicated folders (no preseeding this time), but thankfully it was quick and finished in a few hours.
I also disabled backups on both servers for now, and all seems in sync except one folder where I think the problem was with incomplete replication database on "primary member" sort of being unaware of half of the files in folders - my workaround
worked on that one, just pulled all folder out of it, waited until secondary deleted them, then put them all back in and all seems replicating correctly now, also no more ghost connections.
Truly wondering what caused this madness over time, and mind you, all this setup was new, all was rebuilt on both servers (new logical volumes on both servers - one for each shared folder and replication group, new replication databases, new secondary member,
proper preseeding procedure, etc.) and it seems like this event below might actually be sometimes not so harmless as Microsoft says it is:
Event ID 5014The DFS Replication service is stopping communication with partner DFS1 for replication group domain.com\shared\folder due to an error.The service will retry the connection periodically. Additional Information: Error: 9036 (Paused for backup or restore)
It looks like sometimes, it may happen that after that warning the replication starts working only 1-way and never truly resumes which then in return can cause madness after something like updating ACL on some folder in replication content.
I re-enabled nightly backups on physical server ("primary" DFS member) for now and will keep an eye on it and potential havoc it can wreak across replication groups over time...
Hope it helps anybody stumbling upon similar problem some day ...

Applications Folder permissions errors

I recently used Apple's Migration Assistant when doing a clean install of OS X on my system, and now I am having the following problem:
Whenever I drag an update of an application into my Macintosh HD/Applications folder I get the usual dialog box asking whether I really want to replace the file. After I confirm this action, a second error message appears informing me that I don't have sufficient permissions to complete the action.
I am able to manually move the apps to the trash and then empty the trash.
Any ideas?

On my system if I do a "Get Info" on the Applications folder it shows:
You can: Read & Write
Owner: system
Access: Read & Write
Group: admin
Access: Read & Write
Others: Read only
I've never changed it so I'm assuming those are the correct default permissions. Hope that helps.

Why do my Visitors users get Access Denied in my New Forms - Mobile Devices Only

The issue I have is that I have a SP2013 Site with a group Visitors.
the default Site Permissions have been set to Read.
I then created a SharePoint List with a People Picker.
I broke the Security inheritance and gave the Visitors group Contribute Permissions
In Browser mode, they can access the site, open all links and even add content to list.
When I do the same actions on a mobile device, All the visitors get Access Denied when clicking on the Add Content Link.
The Link I make available is "https://myweb/sites/site/Lists/mylist/NewForm.aspx"
I have found some suggestions about unplublished content, but this does not explain why the user can perform the required actions on a desktop, but not on a mobile device using the same link

Hi,
By mobile do you happen to mean iPhone? There has been quite a few issues with SharePoint 2013 and iOS authentication. You might want to refer to the following exchange.
http://apple.stackexchange.com/questions/146808/ios-8-safari-sharepoint-2013-windows-authentication-support
Eric Overfield - PixelMill -
ericoverfield.com -
@EricOverfield

QTSS file and folder permissions

I am having a lot of problems getting QTSS and QTSS Publisher working correctly. I think this may be due to file and folder permissions. Does anyone know what the correct ownership and access settings should be for the folders containing my quicktime files?
Thanks.

Try setting the ownership and permissions of those files to the ones mentioned on the end of this page, which are: owner: qtss, group: admin, permissions for owner and group: Read & Write, and Read only for others.
(13414)

Groups and permissions

I'm preparing a script where some local groups need to be created then domain groups added to them. Also it'll create some folder structure and assing my local groups with the right permissions. I thought that rather than hardcodding all that it would be
better to make it more general so if groups need to be changed or folder structure modified it can be easily done. Hence I decided to use it as a good opportunity to learn to work with functions to extend my beginner's PS skills.
I started with creating text files with what will be needed later. So I have folders.txt, LocalG.txt and DomainG_A.txt DomainG_B.txt all put in variables
$folders = Get-Content .\folders.txt
$LocalG = Get-Content .\LocalG.txt
$DomainG_A = Get-Content .\DomainG_A.txt
$DomainG_B = Get-Content .\DomainG_B.txt
####### Functions   #################
# Test if folders exist and if not create them
Function TestFolders ($folders){
              foreach($folder in $folders){
                       if((Test-Path $folder) -eq $False){
                            New-Item -Path $folder -ItemType Directory -Force
# Remove all ACLs from existing folder structure in case it's incorrect
Function RemoveACL ($folder) {
$acl = Get-Acl $folder
foreach($access in $acl.Access){
         $acl.SetAclAccessRuleProtection($True, $True)
         $acl.RemoveAccessRuleAll($access)
Set-Acl $folder $acl
# Create Local Groups
Function AddLocalGroups ($Groups){
foreach ($group in $Groups){
         $cn = [ADSI]("WinNT://$env:computername")
         $gp = $cn.Create("Group", "$group")
         $gp.setInfo()
# Here I would like adding domain groups A and B to some of my local groups
Function AddTo_A_Group ($AGroups){
foreach($gp in $AGroups){
           $gr = $gp.Replace('\','/') # as we will likely see domain\group format in the text file
            $objGroup = [ADSI]"WinNT://$gr"
            $objGroupA1 = [ADSI]("WinNT://Test Group 1 A")
            $objGroupA1.PSBase.Invoke('Add',$objGroup.PSBase.Path)
            $objGroupA2 = [ADSI]("WinNT://Test Group 2 A")
            $objGroupA2.PSBase.Invoke('Add',$objGroup.PSBase.Path)
Function AddTo_B_Group ($BGroups){
foreach($gp in $BGroups){
              $gr = $gp.Replace('\','/')
              $objGroup = [ADSI]"WinNT://$gr"
              $objGroupB1 = [ADSI]("WinNT://Test group 1 B")
              $objGroupB1.PSBase.Invoke('Add',$objGroup.PSBase.Path)
              $objGroupB2 = [ADSI]("WinNT://Test group 2 B")
              $objGroupB2.PSBase.Invoke('Add',$objGroup.PSBase.Path)
} # surely this can be done better
# To add a group and assign e.g. read and execute permissions
Function ModifyACL($folder,$group){
$acl = Get-Acl $folder
$rule = New-Object System.Security.AccessControl.FileSystemRule -ArgumentList @(
               $group.Name,
               "ReadAndExecute",
               "ContainerInherit, ObjectInherit",
               "None",
               "Allow"
$acl.AddAccessRule($rule)
Set-ACL $folder $acl
AddLocalGroups($LocalG)            # create local groups based on the contents of LocalG.txt
AddTo_A_Group($DomainG_A)     # add A domain groups to Local groups with A in their name
AddTo_B_Group($DomainG_B)     # add B domain groups to Local groups with B in their name
foreach ($folder in $folders){
           TestFolders($folder)          # test if folders exists and create as needed
           RemoveACL($folder)          # remove all current permissions
           foreach($group in $LocalG){
                   if($group -match "A"){          # for all groups with A in their name
                            ModifyACL($folder, $group)      # add group and give it R&E permissions
Running the above Local groups get created and this is as far as it gets :)
When the script gets to AddTo_A_Group function it throws an exception calling Invoke with 2 arguments: Unknown name(0x80020006 (Disp_E_UNKNOWNNAME) on my $objGroupA.PSBase.Invoke('Add',$objGroup.PSBase.Path)
Some help would be much appreciated.
yaro

Yeah, PSBase is a sort of great unknown for me. I suppose I use [ADSI] as most of similar code (including your neat one-liner :) ) uses it presumably not to need to have connection with any DC.
After adding a couple of write-hosts here and there I'm seeing that although the group name $gr looks correct (here contoso.net/GroupA1) in the next line the $objGroup shows up as System.DirectoryServices.DirectoryEntry and same for $objGroupA1
where I was expecting to see contoso.net/GroupA and contoso/Test Group A 1. $objGroup.Path doesn't show anything but $objGroup.PSBase.Path shows System.DirectoryServices.DirectoryEntry again...
yaro

What does "Group" mean in get info windows?

Hi
What does "Group" mean in get info windows?
and what do the numbers mean when i click other...?

The group is the Unix group to which the file belongs. Every group has a numeric identifier (the gid) as well as an (alphanumeric) name. The numbers you see when you choose "other" in the drop-down menu which selects the group, are the gid's.
For example, an administrative account obtains administrative permissions by virtue of being a member of the "admin" group. Although the folder /Applications is owned by the user root, it is also owned by the group admin which has been given write, as well as read permission. This write permission is precisely what allows any member of the admin group--that is, any administrator of the machine--to drag applications into /Applications. On my computer, the admin group has gid 80, and so that is what I see as the number next to "admin" under "other".
See http://en.wikipedia.org/wiki/Groupidentifier%28Unix%29 for more explanation of groups.
Message was edited by: Mr.Lobotomy to clarify that "other" is still referring to a "group" option, and not to the permission given to "others".

Mac OSX file copy to Windows Share folder permissions

We'd got a few Mac's, one is snow leopard and the other is Lion. The scenario is:
Mac:
Go > Connect to server > smb://servernamehere > Connect > select your share
The authentication box then pops up, they've been typing in a username and password to connect to Server 2008 (Active Directory here by the way). I don't think it matters if they type in "DOMAIN\username" and the password or just "username" and the password.
They try to copy files around but they get this wacky -xx number and their Macs lock up.
On the Windows Server Side I look at the folder permissions and the users they're using are all golden, full permissions. I look at a test folder I create and it too looks good.
The weird thing is this:
If I look at the folders on Windows it looks normal but if I open the command line on a Mac, do:
cd /
cd Volumes
ls
cd Folder_I'm_Connected_To
ls -la | grep testfolder_I_made
I get these results...
drwx------ 1 Their_Username_Here staff --> Some other stuff here like a folder size, date, time and the folder name
My question is this I guess.
Do I have to join these Macs to the Windows domain for the permissions and folder views on the Mac to look right AND to have them funtion properly? The user of the other Mac says she never types in any authentication stuff, she just clicks a folder shortcut on her Mac ans she's in.
I would expect the permissions to at least say something like:
drwxdrwx---
The Windows server doesn't have the group "staff" which makes it seem the Mac isn't looking at the mounted volume in the same way Windows is. They also had this problem on AFP and SMB shares directly on a FreeNAS box which is also BSD like a Mac.
As a result of the Macs behaving similarly on both Windows and BSD (FreeNAS) I think this seems to be some wacky Mac behavior and I just can't figure it out.
Any help would be appreciated.
Thanks.

Hi, same results at the terminal command on a SMB share, observed here with mac computers running with OsX 10.8 with Windows 2008 R2 SMB shares. My issue is that theses computers need to copy files on theses shares with Chronosync or Carbon Copy and this is not working due to an "modify file attributes permissions" error. But if I copy the files using "Finder" it works great.
You don't need to join your computers to your domain to get it to work. The error that you are talking about is the -5000 error ???

Group Folder -- Permissions Get Lost/Denied

Similar Messages

Maybe you are looking for