NTFS folder permissions query

#1
Is there any way of protecting explicitly defined permissions for a sub-folder?

e.g.
Example folder structure

\PERSONAL DATA (read/write)
\PERSONAL DATA\USER 1 (inherited read/write)
\PERSONAL DATA\USER 2 (inherited read/write)
\PERSONAL DATA\SHARED DATA (inherited read/write)
\PERSONAL DATA\SHARED DATA\CONFIDENTIAL (explicit read only)
\PERSONAL DATA\SHARED DATA\ACCOUNTS (inherited read/write)
\PERSONAL DATA\SHARED DATA\SALES (inherited read/write)
\PERSONAL DATA\SHARED DATA\TECHNICAL (explicit access to group)\PERSONAL DATA\SHARED DATA\LEGAL (explicit access to group)



If someone were to look at the permissions at the \PERSONAL DATA\SHARED AREA and choose to 'replace permissions entries on all child objects with entries shown here that apply to child objects' this will force reinheritance again for the CONFIDENTIAL, ACCOUNTS, SALES, TECHNICAL and LEGAL sub-folders. The user is prompted to that effect, however mistakes happen especially when you're training less experienced support technicians.

Does anyone know of a way that we can stop the permissions from being reherited, via third-party software or tweak?

Thanks




Dan
 

Mastershakes

OSNN Veteran Addict
#2
Take away 'Full Control' from everybody except yourself for the folder \Personal Data\Shared Data

Without 'Full Control' one may not modify/change permissions on the folder, or take ownership for that matter.
 
#3
Thanks for the reply. No-one has full-control permissions aside from myself and selected core admins, at best users have only read/write access.

Is it possible to prevent the explicit permissions in the \PERSONAL DATA\SHARED DATA\CONFIDENTIAL (explicit read only) from being reinherited from \PERSONAL DATA\SHARED DATA if someone selects the option to 'replace permissions entries on all child objects with entries shown here that apply to child objects'. I know you are warned that this will affect permissions on child folders, but it would be useful to have another contingency in place.

If third-party tools can be used, they must be Active Directory compatibile.

When you've got 50 parent folders, each containing 30 - 40 child folders and a further 20 - 30 child folders off those, each with permissions set a varying levels, if someone were dumb enough to replace permissions at the root, replacing all permissions on all child objects, it would take hours to sort! :squareeye :mad:

Cheers



Dan
 

Members online

Latest posts

Latest profile posts

Perris Calderon wrote on Electronic Punk's profile.
Ep, glad to see you come back and tidy up...did want to ask a one day favor, I want to enhance my resume , was hoping you could make me administrator for a day, if so, take me right off since I won't be here to do anything, and don't know the slightest about the board, but it would be nice putting "served administrator osnn", if can do, THANKS

Been running around Quora lately, luv it there https://tinyurl.com/ycpxl
Electronic Punk wrote on Perris Calderon's profile.
All good still mate?
Hello, is there anybody in there? Just nod if you can hear me ...
Xie
What a long strange trip it's been. =)

Forum statistics

Threads
61,971
Messages
673,299
Members
89,016
Latest member
Poseeut