J
jack schweigel
The question is - how do we deny the Creator of a Folder the ability to
change ntfs permissions on folders they create?
We have a large amount of shared disk storage for users and groups to use
for their work files. We set up a basic folder structure based on
organization and job function with permissions typically to either
change(R/W) or read(R/O) based mainly on groups. Users/groups do not have
the option to change permissions for the folders we create. For support and
sys admin work IT needs access to all the folder (VERY rarely otherwise) and
this is OKed by our company policies. As the storage grows and evolves,
users create new folders in areas they have rights to and that is fine.
However, we have the occasional curious user who feels the need and
discovers the ability to change permissions for the folders they create -
they are that ubermensch, the CREATOR/OWNER. They often take away system
rights, etc and backups and other things don't work. It seems from our
experimenting that they need Full Control (both Change Permissions and Take
Ownership) to create a new folder. We see folders with all rights taken
away; we have to take ownership to see the empty permissions list.
Inevitably these users are those most in need of support, like file
restores, because they like to "do things." We don't find out that they've
been messing with permissions until there is a problem. By then the horse
is long gone, out the wide-open barn door. We can only shrug while they
wail about "how we could let them do that to themselves." Other than the
larger cultural issue of getting people to take intelligent responsiblity
for their actions, we're looking for a solution to our little problem - how
to close the barn door.
change ntfs permissions on folders they create?
We have a large amount of shared disk storage for users and groups to use
for their work files. We set up a basic folder structure based on
organization and job function with permissions typically to either
change(R/W) or read(R/O) based mainly on groups. Users/groups do not have
the option to change permissions for the folders we create. For support and
sys admin work IT needs access to all the folder (VERY rarely otherwise) and
this is OKed by our company policies. As the storage grows and evolves,
users create new folders in areas they have rights to and that is fine.
However, we have the occasional curious user who feels the need and
discovers the ability to change permissions for the folders they create -
they are that ubermensch, the CREATOR/OWNER. They often take away system
rights, etc and backups and other things don't work. It seems from our
experimenting that they need Full Control (both Change Permissions and Take
Ownership) to create a new folder. We see folders with all rights taken
away; we have to take ownership to see the empty permissions list.
Inevitably these users are those most in need of support, like file
restores, because they like to "do things." We don't find out that they've
been messing with permissions until there is a problem. By then the horse
is long gone, out the wide-open barn door. We can only shrug while they
wail about "how we could let them do that to themselves." Other than the
larger cultural issue of getting people to take intelligent responsiblity
for their actions, we're looking for a solution to our little problem - how
to close the barn door.