Results 1 to 9 of 9
  1. #1
    2 Star Lounger
    Join Date
    Jan 2001
    Location
    Nottingham, UK, Nottinghamshire, England
    Posts
    190
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Permissions in ADS - order of application?

    Hi. I'm by no means an ADS expert but I do have some rights, primarily in order to grant permission to certain users to use directories on our intranet server. However, I've hit a puzzling situation.

    There is a VB6 application that copies a file created on a local drive to a particular folder (let's call it A) on the intranet server. User B has been able to use this application quite happily, as she is a member of Group C which has modify permission in folder A. User B needs to hand over usage of the application to user D. I have put user D in group C - and expected user D to be able to copy a file into folder A, but she can't, she gets the msgbox 'Permission denied'.

    A little experimentation has shown that both users (like the rest of us) are members of a group called, say, 'Permanent Users', which is allowed access into folder A but NOT modify access. User B (like me too) has no problem with this as we have modify permission into folder A through group C. However, I need to (temporarily) allow the 'Permanent Users' group to have modify access into folder A in order that user D is able to (programmatically at least) copy the file from her local disk to folder A. Resetting group 'Permanent Users' back to less than modify access brings back user D's 'Permission Denied' error, even though she is still a member of group C which allows modify rights in folder A!

    Can anyone tell me why this should be? That although both user B and user D are members of both group C and the 'Permanent Users' group, only user B can take advantage of group C's modify permission while user D falls foul of the 'Permanent Users' non-modify restriction?

    Thanks for any help with this!

  2. #2
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,585
    Thanks
    5
    Thanked 1,059 Times in 928 Posts

    Re: Permissions in ADS - order of application?

    Has user D re-booted since the change? Have you carefully checked all the groups to which user user D belongs for appropriate permissions?

    Joe
    Joe

  3. #3
    2 Star Lounger
    Join Date
    Jan 2001
    Location
    Nottingham, UK, Nottinghamshire, England
    Posts
    190
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Permissions in ADS - order of application?

    Thanks for the reply. Yes, the user has rebooted - we've been trying to sort this out for a day or two! And adding modify permission to the 'Permanent Users' group allows her to copy the file immediately without rebooting. Remove the modify permission and she's back to square one!

    As to the other groups, well we're all members of multiple groups, and I haven't checked all of hers, but it's very unlikely that she's a member of another group with permission in the folder. Anyway, it's still the case that altering the modify permission for group 'Permanent Users' gives her or denies her 'Copy File' rights, even though her membership of group C should allow it as it does for user B!

  4. #4
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,585
    Thanks
    5
    Thanked 1,059 Times in 928 Posts

    Re: Permissions in ADS - order of application?

    What OS version are you running on the server and workstation? Both fully patched? Have you tried to search the MSKB?

    Joe
    Joe

  5. #5
    2 Star Lounger
    Join Date
    Jan 2001
    Location
    Nottingham, UK, Nottinghamshire, England
    Posts
    190
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Permissions in ADS - order of application?

    We're using Windows 2000 5.00.2195 Service Pack 4. As far as I know all fully patched up. And I have't found anything in the KB but maybe I'm asking the wrong question.

  6. #6
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,585
    Thanks
    5
    Thanked 1,059 Times in 928 Posts

    Re: Permissions in ADS - order of application?

    Anything in the event logs of either the server or the workstation? Here's Search The Knowledge Base for "troubleshoot active directory". Have you already found most of these?

    Joe
    Joe

  7. #7
    2 Star Lounger
    Join Date
    Jan 2001
    Location
    Nottingham, UK, Nottinghamshire, England
    Posts
    190
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Permissions in ADS - order of application?

    No, nothing in the logs. I had a look in the Kb using your link, but I can't find anything that seems relevant. After all, everything seems to be ok, except that AD appears to ignore the granted modify permission for user D and yet allow it for user B! Is there anything in the order in which these things are applied?

  8. #8
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,585
    Thanks
    5
    Thanked 1,059 Times in 928 Posts

    Re: Permissions in ADS - order of application?

    I'm sure there is some order but what it is I do not know. Here's another search that may help: howto debug active directory permissions - Google Search.

    Joe
    Joe

  9. #9
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,585
    Thanks
    5
    Thanked 1,059 Times in 928 Posts

    Re: Permissions in ADS - order of application?

    There are several interesting links in MSN Search: troubleshoot active directory permissions.

    Joe
    Joe

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •