Chat for Twisty and user66001

Twisty

19:32

Hi

user66001

19:47

Hi

Twisty

@user66001 So, the permissions if applied as shown in my answer don't let your target user group create folders directly in the Two folder. Yet, you're saying that they actually can do so?

Or that perhaps you want them to be able to do that?

user66001

20:19

By following those settings (wish there was a single GUI screen where I can show one all the settings in a single screenshot) the only thing that differs from the stated result, is the ability to go (as one way to create a new folder) right-click -> New -> Folder and it will create "New Folder" (or append it with (n) if already existing) in the "Two" folder, but will not let that user rename it.

The user in question should not be able to create anything in the "Two" directory.

Twisty

Can you post a screen shot of the "Advanced" permissions screen for the TWO folder?

Twisty

20:40

@user66001 Actually, it would also be helpful to see a screenshot of the Effective Permissions tab for the user in question as well

user66001

That was I was meaning by the "wish there was a single GUI...". The screenshot will only show the user and the 2 Allow, and 1 Deny permission and what they apply to, not the actual permissions. Still interested?

Twisty

Yes, as long as you don't mind my asking for more details afterward! :)

user66001

Ah! Silly MS. Can't make the window bigger to show in one screenshot the effective permissions for the user either. The ticked lines are however: Traverse folder / execute file, List folder / read data, Read attributes, Read extended attributes, Read permissions, Change permissions.

Twisty

Hmm...those aren't enough permissions to permit creating a folder.

Yeah, so shoot me a pic of the Permissions tab

The +Change permissions permission doesn't belong in that list of Effective Permissions. Somehow we've got some extra permissions in play.

user66001

21:01

I only put the Change Permissions rights in there as I am using my account to test this, and was trying not to login as another account to change permissions post the initial change for testing. I would be troubled if that right changed the ability to rename or create folders.

Twisty

I see.

So, you really need two separate accounts (or user groups) for this to work. One will get the exact permissions specified in my answer, while the second should have Full Control over the entire folder structure. That second account would create the needed subfolders in the TWO folder, while the first would only have the specific rights described in my answer.

This is what the Advanced Permissions screen should look like for the TWO folder. Obviously it doesn't show the specific permissions for those marked "Special". How does this compare to yours?

user66001

Why exactly can't I use my own account? I have an admin login to go and wipe it away when testing is done. My account has the same permissions in your answer, so regardless of the extra ability to change permissions (which as far as I am aware has to be explicitly changed, not done as a function of creating files, folders, renaming, etc) it should operate as intended, and it does (can't delete folders, create files in parent, etc) only that new folders (without renaming) can be created.

Apart from the Administrator line, exactly the same.

Twisty

21:17

No, I wasn't saying you can't use your account. Just observing that you'll need more than one account for ongoing use of the folder structure since the specific permissions from my answer don't grant users the ability to create files or folders in the TWO folder

user66001

Ah, this is just a proof of principle. The actual permissions need to be applied to 1000's of folders that I need to create script for.

Twisty

OK, can you run the command icacls C:\TWO /t and post the result? Update path to your TWO folder and change usernames in the output as you see fit.

user66001

m:\>icacls m:\Two /t

m:\Two NEWCOMPANY\tester:(CI)(NP)(IO)(DENY)(D)
NEWCOMPANY\tester:(OI)(CI)(RX,WDAC)
NEWCOMPANY\tester:(OI)(CI)(IO)(M)

m:\Two\12345 NEWCOMPANY\tester:(I)(DENY)(D)
NEWCOMPANY\tester:(I)(OI)(CI)(RX,WDAC)
NEWCOMPANY\tester:(I)(OI)(CI)(M)

m:\Two\12345\Test.txt NEWCOMPANY\tester:(I)(RX,WDAC)
NEWCOMPANY\tester:(I)(M)

m:\Two\54321 NEWCOMPANY\tester:(I)(DENY)(D)
NEWCOMPANY\tester:(I)(OI)(CI)(RX,WDAC)
NEWCOMPANY\tester:(I)(OI)(CI)(M)

m:\Two\54321\Test NEWCOMPANY\tester:(I)(DENY)(D)

Twisty

Hang on while I look at this...

@user66001 LOL. It's the change permissions permission. Drop that and it should work as expected.

That's wild...

user66001

21:42

What on earth. That does work, but WHY!?!

Twisty

Well, I can't answer exactly, but it does make sense. A user that has permission to change the permissions should by extension be able to grant himself the right to create/delete/add/whatever.

I always thought the user had to actually go in and edit the ACL to make this happen, but guess not.

user66001

Explicitly, yes, not having Explorer probing the permissions to temporarily change the permissions, then back again.

Same

Twisty

Right.

user66001

I return back to my "Silly MS" point. No doubt others have struck this and wasted time working it out.

Twisty

Dunno. Seems like a lot of admins (myself included) find parts of the NTFS permissions mystifying...like needing the Delete permission to rename a file or folder.

Anyway, with these permissions in place, ALL of your subfolders will start acting how you need them to...so hopefully for those 1000s of subfolders you really don't need to apply a bunch of permissions. Just make sure you force the permissions applied to the TWO folder to replace existing permissions on child objects.

user66001

21:47

That actually makes more sense to me due to what I understand is required by a very low level rename operation, but don't believe it should be that way,

Twisty

Searching for an answer to this is madly hampered by the phrase "change permissions" appearing in every post explaining how to do basic NTFS permission management. :-/

Meh. Anyway, glad we got it sorted. Blessings to you. Ping me if you need anything else.

user66001

We wanted a way to monitor this, and not click and wait while it takes an indeterminate amount of time to parse every folder and file. That framework would also be helpful for cases where non-inherited permissions are desired for a large number of folders.

Thanks for you help!

Transcript for

Chat for Twisty and user66001