Troubleshooting permissions in Vista is no easy task. Tracking down an access denied error is particularly difficult when you start mixing share permissions with NTFS folder and file permissions. In this series of articles, I’ll discuss two of the common problems individuals run into when working with permissions — cumulative permissions and moving or copying resources.

Understanding how permissions interact isn’t difficult if you stick with these rules:

  • When working within a certain permission type (sharing or NTFS), permissions are cumulative. The most lenient setting wins for a particular user or group. Deny always overrides Allow and negates any permission with which it conflicts.
  • When there’s a difference between the sharing permission and the NTFS permission, the most restrictive setting wins.
  • Permissions are not cumulative across groups; each group’s permission is calculated separately. For example, if a user is a member of Group A, which has Full Control sharing permission but no NTFS permission for an object, and also of Group B, which has Full Control NTFS permission but no sharing permission for the object, that user has no permission for the object.

Let’s look at some examples. Say that on Tim’s PC is a folder, FOLDER-A, containing a file, PRIVATE.DOC. Tim has shared FOLDER-A with the Marketing group with Contributor permission level and with the Everyone group with Reader permission level. In the NTFS permissions for the folder, he has allowed for the Marketing group to have only Read access. He has removed the default permissions to the folder for the Everyone group. If Sarah from Marketing accesses PRIVATE.DOC, will she be able to make changes to it? The Marketing group has Contributor (for sharing) and Read (for NTFS), with a net result of Read. The Everyone group has Reader (for sharing) and None (for NTFS), with a net result of None. So Sarah’s permissions are the least restrictive of Read and None — in other words, Read. So no, she cannot make changes.

  Sharing Permission NTFS Permission Net Permission
Marketing Group Contributor Read Read
Everyone Group Reader None None

Cumulative permission = Read

Now, suppose Tim adds another group to his list of NTFS permissions: Managers. He gives the Managers group Modify access to FOLDER-A. If Sarah is a member of the Managers group, will she now be able to make changes to PRIVATE.DOC? The answer is still no, because even though permissions are cumulative within a type, they’re calculated as a whole on each group. As you can see below, the new Managers group has no net permission to the folder because it has no sharing permission, so it doesn’t help
Sarah to be able to modify the file.

  Sharing Permission NTFS Permission Net Permission
Marketing Group Contributor Read Read
Managers Group None Modify None
Everyone Group Reader None None

Cumulative permission = Read

Permission changes don’t take effect until the end user logs off and logs back on. After Tim changes the permissions, Sarah must log off and back on again or close the network connection to Tim’s PC and reopen it in order for his permission changes to take effect on Sarah’s end.

If Tim wanted to make sure Sarah had the ability to modify the file, he could:

  • Give the Marketing group Modify (or better) permission under NTFS permissions.
  • Give the Managers group Contributor or Change permission under sharing permissions.

Let’s say Tim takes the first option and changes the Marketing group’s NTFS permission to Modify. Now the chart looks like this:

  Sharing Permission NTFS Permission Net Permission
Marketing Group Contributor Modify Change/Modify
Managers Group None Modify None
Everyone Group Reader None None

Cumulative permission = Change/Modify

Now, suppose Tim uses the NTFS special permissions to deny the Managers group the Write permission. Will Sarah be able to edit the file? No, because the Deny option settings override any Allow settings. Even though the Marketing group still has the right to edit the file, Sarah is also a member of the Managers group, which is specifically denied access.

  Sharing Permission NTFS Permission Net Permission
Marketing Group Contributor Modify Change/Modify
Managers Group None Deny Write Deny Write
Everyone Group Reader None None

Cumulative permission = Deny Write

If Tim wanted Sarah, but nobody else from the Managers group, to be able to change the file, he could either remove Sarah from that group or create a separate group containing everyone from Managers except Sarah and deny that group the Write access instead of denying the Managers group.

[rsslist:http://ah.pricegrabber.com/export_feeds.php?pid=hjehfab&document_type=rss&limit=25&topcat_id=all&category=topcat:all&col_description=1&form_keyword=vista]