RE: [ActiveDir] Home Directories

Fri, 27 May 2005 05:33:39 -0700

Title: RE: [ActiveDir] Home Directories

Agreed… I’m still a little fuzzy on the details since Debbie had responded that “…both share level and file level permission on the home directory is change…” and follows up with “…domain users have read permission to the home share…”.

 

Debbie, can you enumerate the share level permissions of the home share in detail?

 

:m:dsm:cci:mvp

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Al Mulnick
Sent: Friday, May 27, 2005 8:05 AM
To: [email protected]
Subject: RE: [ActiveDir] Home Directories

 

Debbie, what process did you use to move the files?  Just cut/paste?  Or some other method?

 

Effective permissions? Are there others we should be aware of?

Can you detail the exact process you used to configure and the exact permissions that are set?

 

Give us a sense of the scope of the problem.  Is this just for a few users that were moved?  Or all users that were moved?  Are they all exhibiting the same behavior exactly?  How many users are we talking about that exhibit the problem?

 

 

I'm still drinking my coffee this morning but I'm trying to remember the reason why a user who was granted change permissions on objects they didn't create (I bet it was created by the administrator during the move process) can't delete those objects :)  

 

Something about giving the user ownership of those objects which they would have if they created the files (on the target), but not if they were created by the administrator when they were moved. The user has the right to make changes, but not to delete or add the objects because they are too restricted.  The administrator on the other hand, has those rights.

 

You need to likely change the rights you've granted else give the user the ownership of those files you've moved.  I think we need to see the rest of the details however before jumping to the final conclusions however. 

 

Al

 

 

 

From: [EMAIL PROTECTED] on behalf of Ellis, Debbie
Sent: Fri 5/27/2005 6:31 AM
To: '[email protected]'
Subject: RE: [ActiveDir] Home Directories

I did not have problems copying the files over. I am a domain admin and
don't have problems with the files. Both share level and file level
permission on the home directory is change.  I even blocked the inheritance
from the top level Home folder. All our users are members of domain users
group. Domain users have read permission to the home share.  I removed the
domain users group from the permissions of the individual home directories.
The only permission given are for full control for Domain Admins and change
for the individual user for the home directory.

-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Medeiros, Jose
Sent: Thursday, May 26, 2005 6:34 PM
To: [email protected]
Subject: RE: [ActiveDir] Home Directories

No problem in disagreeing, as long as we can respect each others opinions.

Granted Debbie did not give a us lot of details,  but based on what Debbie
wrote, it sounds like she is having trouble copying the files from the
server, and if her users had full control enabled on the original NT 4 home
directory, then in the middle of the move process she would probably have an
access denied even though she is the admin.

By taking ownership of the files prior to her move this issue would be
resolved. She also stated that the permissions are change ( Change for end
users is better then Full control in my option) and Debbie stated that she
has moved some of the files and that leads me to believe that the
permissions on the target server have at least write access at the Share and
NTFS permission level.

I am also sure that Debbie was at least smart enough to verify the share
level and file permissions on the new target server prior to posting on this
list, however I doubt if she went through all the files on the source server
to verify that none of them had full control as a ACL for the user account
in question.

The other issue that she me be experiencing is that if the files are
currently in use the they will be locked also stopping the move process from
occurring.

Well that's my two cents,

Jose

------------------------------------------------------
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED]
Sent: Thursday, May 26, 2005 3:05 PM
To: [email protected]
Subject: RE: [ActiveDir] Home Directories


I disagree.  Taking ownership isn't going to fix the permissions issues for
the user at the opposite end.  I'm leaning towards a share-level permission
problem, since 2003 by default sets shares at Everyone:Read while NT was
Everyone:Full Control.

:m:dsm:cci:mvp



From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] On Behalf Of Medeiros, Jose
Sent: Thursday, May 26, 2005 4:00 PM
To: [email protected]
Subject: RE: [ActiveDir] Home Directories

Hi Debbie,

This sounds like you need to take ownership of all the files in each home
directory before moving the data.

Jose
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Ellis, Debbie
Sent: Thursday, May 26, 2005 12:45 PM
To: '[email protected]'
Subject: [ActiveDir] Home Directories
We are in the process of moving our user's  home directories from  NT server
to 2003 server.  We have moved some and have ran into a problem. The user's
are unable to delete or add but the effective permissions is change access.
Has anyone ran into this issue?

List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/

Reply via email to