Need help understanding users and permissions to secure new system

By the way, the actual error I was getting regarding propagation of permissions is

"Stopping the propagation of [COLOR=#3676A2 ! important][COLOR=#3676A2 ! important]permission[/COLOR][/COLOR] settings leads to an inconsistent state, in which some objects have the settings but others don't. If you made the change by mistake, you should apply the [COLOR=#3676A2 ! important][COLOR=#3676A2 ! important]correct[/COLOR][/COLOR] change immediately to achieve a consistent state."

This page has an example of such an error occurring, and a possible hint of
how to get out of it:

Solved I am in a loop trying to grant myself permission - Vista Forums

Clearly, this problem exists in Vista as well as Windows 7. But I still don't
understand why it is occurring for me.

Sigh. Okay, I'll stop adjustments for now, in the hope that
someone else might be able to gain some insight into the problems.
I really, really hope that someone can find an answer within the
next 48 hours or so, as I'm already way behind where I should be
on getting this system up and running.

It sounds like somebody at Microsoft really needs to write a program
analogous to CHKDSK, to check the consistency of the permissions/
rights tree. They could call it CHKPERM. I imagine it would be a tough
program to write, given that different rights are stored in different
places, but if the company is going to provide end users with a system
that can so easily be put into an inconsistent state, they ought to
make the effort. It's not like they don't have any money to spend. :-(

Steve,

I talked with Brink, one of the Admins here, and the fellow that writes most of the tutorials, and he told me he looked into your situation here, but because it was getting late for him. He had to sleep on it, and once he had his day organized he was going to post with some advice.

No problem; thanks for replying. Sleep is a good thing! Thanks for the
info on the use of the Snipping Tool. I had read a little about that, and
I guess I'll be getting some practice soon. I have historically used a
program called ScreenHunter for this purpose, but since that isn't on
my laptop yet, I'll use the Snipping Tool.

Once you told me that your log-on screen was black instead of the normal blue I am thinking there may be bigger problems here, I hope not.

I hope not too. It is black because somehow my account doesn't have
permission to open the Desktop file. Which implies that I took away one
permission too many. I'm guessing that denying all permissions to the
User group might be the culprit.

I probably won't be back online until late this afternoon (PST).
Thanks for all your efforts to track down the problem!

Anak,

I appreciate your advice, but will it really do any good to do a
System Restore? Not opening the desktop is clearly a permissions
issue, which should be curable by setting the permissions correctly.

If I do a System Restore, this might put me back to a point before
the problem occurred, but it still tells me nothing about how to set
the permissions correctly in the first place. What is to prevent me
from having the same problems again if I try to re-apply the earlier
instructions?

One thing it occurs to me to ask is, has anyone on your end actually
tried to reproduce the problem? I realize that none of you may have
re-partitioned your drive, but it isn't clear yet (to me, at any rate) that
the partitioning had anything to do with the problem. So, for example,
suppose your machine has an account with user name RabbitFoot,
and that you have logged in as an administrative user. (And suppose
that you have just created another restore point to make sure you
can back out easily if the following test messes up your machine.)
Further suppose that you look at the permissions on the folder
C:\Users\RabbitFoot. Now, explicitly Deny all permissions for the
Users group. When you click the Apply button, what happens?
Is your action quietly accepted, or do you see any of the error
messages I reported? And if you see any of the error messages,
can you escape from the error dialogs without having to log out
of your account?

I'm really curious to know whether any of you have seen the
problem first-hand, and I hope that if you do, it might give you
some insight into what is going on. It seems like there are three
major possibilities for my problems:

1. Partitioning the drive or the way in which I moved the existing
folders to the new partition somehow caused the problem.

2. There is a serious bug or design flaw in Microsoft's rights and
permissions architecture.

3. Or (perhaps my best hope), none of us fully understands how
the rights and permissions architecture really works, and we're
missing some key bit of information about how to make a folder
unreadable by others, but still readable by oneself. (For example,
in addition to Allowing all permissions for user RabbitFoot and
Denying all permissions to the Users group and the Authenticated
users group, might I need to explicitly remove user RabbitFoot
from either of the groups that I am denying all permissions to,
since Microsoft errs on the side of denying permissions when
more than one possible set of permissions applies?)

Thanks for keeping me up to date, and let me know if you get any
interesting experimental results.