Permission Puzzle: Can't Exclude User but Allow Others to Access

chev65 said:

Which is why my way "the right way" is also the "ONLY" way to do this. I'm not about to go back and forth with anyone on this because as I've already mentioned, it's been tried many times and proven to work, there is no need to use any other method for this. There is also an easy way "same method" to allow access for this new user 6.

It's also easier to use the "Public" folders for this type of sharing because access to the Public folders is not limited with NTFS permissions.

I am trying your way AND IT WORKS as I wrote and thanked you previously. If, however, you know of a "same method" way to use sharing permissions and not NTFS which would allow User account 6 (which is now on the same PC as User account 5, AND which PC is not a member of Homegroup) in addition to User accounts 1-4 (which are on PC's that are in Homegroup) to have access to all five folders, and still exclude User account 5 from folders 1-4 but still give User account 5 access to folder 5, I would greatly appreciate your posting it. I won't forget to rep you. Thanks.

Kaktussoft said:

tobor8thman said:

Kaktussoft said:

So user folder 1 to 4: Permissions allow HOMEGROUP. Most likely you removed EVERYONE and made the permission explicit instead of inherit(?)

user folder 5: Permissions allow HOMEGROUP and EVERYONE. Don't know yet if they are inherited or explicit on folder.
--------------
User folder 1 to 4 are accessible by all members of group HOMEGROUP. Give group MYGROUP access as well to user folder 1 to 4 (NTFS permissions). But first create the group and put the useraccount6 in that group.

Later you can add useraccount7 to MYGROUP to give him access as well.

Just made User Account 6 a member of MYGROUP through lusrmgr.msc. Added MYGROUP to NTFS permissions of folders 1-4 and set for "Full Control". RESULT: User Account 6 is denied access. I think you have to put Everyone in the NTFS permissions--it appears to work when you do that. But if you do that, then User 5 will have access to folders 1-4. I don't understand why your approach would not work, you should be able to list an individual user account or groups containing the user account under the permissions without including "Everyone" too to make it work, shouldn't you?

You're totally right. Please post screenshot of userfolder1 permissions. Please post screenshot of mygroup members as well.

Here is the screen shot of the NFTS settings for one of the five folders to which Homegroup has full control access. Allen_Lenovo_3F_A (User account 6) is the user on PC5 (which is outside the Homegroup but is inside the Workgroup) Allen needs access to folders 1-5. But just putting his user account in the permissions is not enough; he is denied access. He only gets access when you put Everyone in the settings too. But if you do that, the other user account (User Account 5) gains access to folders 1-5 too, when he is only supposed to have access to Folder 5.

I have not provided a screen shot of MyGroup because only User Account 6 is in the group, and he is listed specifically (Allen_Lenovo). I gave "Everyone" Read access only just to see if it affects Allen_Lenovo's Full Control. The two NFTS settings should be cumulative, which means I guess that Allen (User account 6) would have Full Control, not just Read permission. But everyone else in the Workgroup (like User account 5) would have only Read permission). I would prefer no permission for User Account 5, but Read is the most limited I can get so far I think. Thanks for your help.

Kaktussoft said:

No homegroup,mygroup in permissions? No user5, user6 in permissions?

Is that folder really shared?

Here is the problem:Chev65 has the right permission structure (putting Homegroup in shared permissions of folders 1-4 and not touching default NFTS permissions) as long as I have four user accounts in Homegroup that need access to folders 1-4. If I have one user account in Workgroup which needs to be excluded from folders 1-4 but have access to folder 5, this works too because I just put "Everyone" in the shared permissions of folder 5. Why? Because although user account 5 is not in Homegroup, it is part of the group "Everyone."

The moment I add a second user account (user account 6) on the SAME PC as user account 5, which means that both user accounts 5 and 6 are in Workgroup and not Homegroup, and THEN try to give user account 6 access to folders 1-5 through the NFTS permissions and deny user account 5 access to folders 1-4 and access to folder 5, I can't do it without ALSO unintentionally giving user account 5 access to folders 1-4. This happens when I put "Everyone" in NFTS permissions with Full Control because user account 5 is part of the group "Everyone." If, however, I don't put "Everyone" in NFTS permissions, then no members of Workgroup (user accounts 5 and 6) get access because they are not part of "Homegroup." So I don't know how to proceed from this point to give user account 6 access to folders 1-5 but deny access to user account 5 to folders 1-4 and grant access to user account 5 to folder 5.

Kaktussoft said:

How logs user5 on to that server? As guest or as user5?

User account 5 logs in as user account 5. User account 6 logs in as user account 6. No one logs in as "Guest."

I tried leaving "Everyone" in the NFTS permissions AND added a Full Deny specifically for user account 5 in the NFTS permissions for folders 1-4 . (Recall, I had discovered that if I removed "Everyone" from the NFTS permissions, then User accounts 5 AND 6, not just 5, are excluded from any access because they are in Workgroup and not in Homegroup.) I thought by using "Deny" to fully exclude user account 5 from those folders, it would exclude user account 5 and still provide full access to user account 6.

Even Microsoft in a pop up window which occurs when you use "Deny" proclaims that if you use "Deny", it would supersede any of the permissions in a group, like Everyone. So, I reasoned, if "Everyone" gives user account 5 full control (because it is part of that group)," then "Deny" should strip those permissions away.

Yet, NOTHING was affected--user account 5 still had full control over folders 1-4. So, this is where it rests. I have no idea how you can use "deny" for anything if it does not supersede the settings of a group setting.

Kaktussoft said:

user5 and user6 .... hmmm are user5 and user6 real usernames on the machine that has folder 1-4? Are you really logging on with those names on that machine?

No, I am just using those names here in this forum as a simple way to illustrate the problem. The real user account names are much longer.

User accounts 5 and 6 are not on the same PC as the four folders. The PC which has folders 1-4 is a PC running Windows 8.0 Pro. User accounts 5 and 6 are on a separate networked PC in Workgroup running Windows 7.0 Professional.