Stopping folder owners from changing permissions

In an existing folder a user with modify access can create a folder. That user becomes the owner of the new folder, which inturn means that they are granted full control of that folder. This means that a user has the ability to change permissions for the folder, which is not ideal because the user can then remove the Administrators access to the folder, stopping it from being backed up to tape due to the Administrator not having the permission to access the file. I know that the Admin can take back ownership but I would prefer that this situation didnâ??t happen in the first place.

Also we are trying to move toward using permission groups and by allowing the user to change permissions they are able to go around this and add individuals. Is there any ways to stop the creator of a folder from gaining the ability to change permissions? I tried denying this special permission but it didnâ??t seem to work, maybe I wasnâ??t doing it right. Has anyone got any ideas on this? Thankyou

Lionel
Fri May 21 03:37:46 CDT 2004

"TG" <anonymous@discussions.microsoft.com> a écrit dans le message de
news:32CF18FD-7EEB-49FD-B701-F48AE1327168@microsoft.com...
> In an existing folder a user with modify access can create a folder. That
user becomes the owner of the new folder, which inturn means that they are
granted full control of that folder. This means that a user has the ability
to change permissions for the folder, which is not ideal because the user
can then remove the Administrators access to the folder, stopping it from
being backed up to tape due to the Administrator not having the permission
to access the file. I know that the Admin can take back ownership but I
would prefer that this situation didnâ??t happen in the first place.

Since backup operators and administrators have the backup privilege,
a well-written backup application will bypass the permissions.

> Also we are trying to move toward using permission groups and by allowing
the user to change permissions they are able to go around this and add
individuals. Is there any ways to stop the creator of a folder from gaining
the ability to change permissions? I tried denying this special permission
but it didnâ??t seem to work, maybe I wasnâ??t doing it right. Has anyone got
any ideas on this? Thankyou.
>

Change the ACL so they can only modify the file _data_, not the metadata.
(The "Advanced" button in the security dialog box will give you access to
these settings).