Permission Puzzle: Can't Exclude User but Allow Others to Access

[tobor8thman]

Which is why my way "the right way" is also the "ONLY" way to do this. I'm not about to go back and forth with anyone on this because as I've already mentioned, it's been tried many times and proven to work, there is no need to use any other method for this. There is also an easy way "same method" to allow access for this new user 6.

It's also easier to use the "Public" folders for this type of sharing because access to the Public folders is not limited with NTFS permissions.

I am trying your way AND IT WORKS as I wrote and thanked you previously. If, however, you know of a "same method" way to use sharing permissions and not NTFS which would allow User account 6 (which is now on the same PC as User account 5, AND which PC is not a member of Homegroup) in addition to User accounts 1-4 (which are on PC's that are in Homegroup) to have access to all five folders, and still exclude User account 5 from folders 1-4 but still give User account 5 access to folder 5, I would greatly appreciate your posting it. I won't forget to rep you. Thanks.

 

[tobor8thman]

So user folder 1 to 4: Permissions allow HOMEGROUP. Most likely you removed EVERYONE and made the permission explicit instead of inherit(?)

user folder 5: Permissions allow HOMEGROUP and EVERYONE. Don't know yet if they are inherited or explicit on folder.
--------------
User folder 1 to 4 are accessible by all members of group HOMEGROUP. Give group MYGROUP access as well to user folder 1 to 4 (NTFS permissions). But first create the group and put the useraccount6 in that group.

Later you can add useraccount7 to MYGROUP to give him access as well.

Just made User Account 6 a member of MYGROUP through lusrmgr.msc. Added MYGROUP to NTFS permissions of folders 1-4 and set for "Full Control". RESULT: User Account 6 is denied access. I think you have to put Everyone in the NTFS permissions--it appears to work when you do that. But if you do that, then User 5 will have access to folders 1-4. I don't understand why your approach would not work, you should be able to list an individual user account or groups containing the user account under the permissions without including "Everyone" too to make it work, shouldn't you?

You're totally right. Please post screenshot of userfolder1 permissions. Please post screenshot of mygroup members as well.

Here is the screen shot of the NFTS settings for one of the five folders to which Homegroup has full control access. Allen_Lenovo_3F_A (User account 6) is the user on PC5 (which is outside the Homegroup but is inside the Workgroup) Allen needs access to folders 1-5. But just putting his user account in the permissions is not enough; he is denied access. He only gets access when you put Everyone in the settings too. But if you do that, the other user account (User Account 5) gains access to folders 1-5 too, when he is only supposed to have access to Folder 5.

I have not provided a screen shot of MyGroup because only User Account 6 is in the group, and he is listed specifically (Allen_Lenovo). I gave "Everyone" Read access only just to see if it affects Allen_Lenovo's Full Control. The two NFTS settings should be cumulative, which means I guess that Allen (User account 6) would have Full Control, not just Read permission. But everyone else in the Workgroup (like User account 5) would have only Read permission). I would prefer no permission for User Account 5, but Read is the most limited I can get so far I think. Thanks for your help.

 

[Kaktussoft]

Just made User Account 6 a member of MYGROUP through lusrmgr.msc. Added MYGROUP to NTFS permissions of folders 1-4 and set for "Full Control". RESULT: User Account 6 is denied access. I think you have to put Everyone in the NTFS permissions--it appears to work when you do that. But if you do that, then User 5 will have access to folders 1-4. I don't understand why your approach would not work, you should be able to list an individual user account or groups containing the user account under the permissions without including "Everyone" too to make it work, shouldn't you?

You're totally right. Please post screenshot of userfolder1 permissions. Please post screenshot of mygroup members as well.

Here is the screen shot of the NFTS settings for one of the five folders to which Homegroup has full control access. Allen_Lenovo_3F_A (User account 6) is the user on PC5 (which is outside the Homegroup but is inside the Workgroup) Allen needs access to folders 1-5. But just putting his user account in the permissions is not enough; he is denied access. He only gets access when you put Everyone in the settings too. But if you do that, the other user account (User Account 5) gains access to folders 1-5 too, when he is only supposed to have access to Folder 5.

I have not provided a screen shot of MyGroup because only User Account 6 is in the group, and he is listed specifically (Allen_Lenovo). I gave "Everyone" Read access only just to see if it affects Allen_Lenovo's Full Control. The two NFTS settings should be cumulative, which means I guess that Allen (User account 6) would have Full Control, not just Read permission. But everyone else in the Workgroup (like User account 5) would have only Read permission). I would prefer no permission for User Account 5, but Read is the most limited I can get so far I think. Thanks for your help.

No homegroup,mygroup in permissions? No user5, user6 in permissions?

Is that folder really shared?

 

[tobor8thman]

No homegroup,mygroup in permissions? No user5, user6 in permissions?

Is that folder really shared?

Here is the problem:Chev65 has the right permission structure (putting Homegroup in shared permissions of folders 1-4 and not touching default NFTS permissions) as long as I have four user accounts in Homegroup that need access to folders 1-4. If I have one user account in Workgroup which needs to be excluded from folders 1-4 but have access to folder 5, this works too because I just put "Everyone" in the shared permissions of folder 5. Why? Because although user account 5 is not in Homegroup, it is part of the group "Everyone."

The moment I add a second user account (user account 6) on the SAME PC as user account 5, which means that both user accounts 5 and 6 are in Workgroup and not Homegroup, and THEN try to give user account 6 access to folders 1-5 through the NFTS permissions and deny user account 5 access to folders 1-4 and access to folder 5, I can't do it without ALSO unintentionally giving user account 5 access to folders 1-4. This happens when I put "Everyone" in NFTS permissions with Full Control because user account 5 is part of the group "Everyone." If, however, I don't put "Everyone" in NFTS permissions, then no members of Workgroup (user accounts 5 and 6) get access because they are not part of "Homegroup." So I don't know how to proceed from this point to give user account 6 access to folders 1-5 but deny access to user account 5 to folders 1-4 and grant access to user account 5 to folder 5.

 

[Kaktussoft]

How logs user5 on to that server? As guest or as user5?

 

[tobor8thman]

How logs user5 on to that server? As guest or as user5?

User account 5 logs in as user account 5. User account 6 logs in as user account 6. No one logs in as "Guest."

I tried leaving "Everyone" in the NFTS permissions AND added a Full Deny specifically for user account 5 in the NFTS permissions for folders 1-4 . (Recall, I had discovered that if I removed "Everyone" from the NFTS permissions, then User accounts 5 AND 6, not just 5, are excluded from any access because they are in Workgroup and not in Homegroup.) I thought by using "Deny" to fully exclude user account 5 from those folders, it would exclude user account 5 and still provide full access to user account 6.

Even Microsoft in a pop up window which occurs when you use "Deny" proclaims that if you use "Deny", it would supersede any of the permissions in a group, like Everyone. So, I reasoned, if "Everyone" gives user account 5 full control (because it is part of that group)," then "Deny" should strip those permissions away.

Yet, NOTHING was affected--user account 5 still had full control over folders 1-4. So, this is where it rests. I have no idea how you can use "deny" for anything if it does not supersede the settings of a group setting.

 

[Kaktussoft]

How logs user5 on to that server? As guest or as user5?

User account 5 logs in as user account 5. User account 6 logs in as user account 6. No one logs in as "Guest."

I tried leaving "Everyone" in the NFTS permissions AND added a Full Deny specifically for user account 5 in the NFTS permissions for folders 1-4 . (Recall, I had discovered that if I removed "Everyone" from the NFTS permissions, then User accounts 5 AND 6, not just 5, are excluded from any access because they are in Workgroup and not in Homegroup.) I thought by using "Deny" to fully exclude user account 5 from those folders, it would exclude user account 5 and still provide full access to user account 6.

Even Microsoft in a pop up window which occurs when you use "Deny" proclaims that if you use "Deny", it would supersede any of the permissions in a group, like Everyone. So, I reasoned, if "Everyone" gives user account 5 full control (because it is part of that group)," then "Deny" should strip those permissions away.

Yet, NOTHING was affected--user account 5 still had full control over folders 1-4. So, this is where it rests. I have no idea how you can use "deny" for anything if it does not supersede the settings of a group setting.

user5 and user6 .... hmmm are user5 and user6 real usernames on the machine that has folder 1-4? Are you really logging on with those names on that machine?

 

[Kaktussoft]

On the system that has folder 1-4:

1. right click "computer" and select "manage"
2. Click "shared folders"
3. Now you see "shares","sessions" and "opened files"

Which user has sessions and/or open files?

 

[Kaktussoft]

Go to Control Panel > Network and sharing center > Change advanced sharing settings > Enable Turn ON password protect sharing option

Turn it ON for your current profile, which is HOME I think(?) or was that setting already on? Was profile HOME? If setting is OFF ... nobody has to enter password and logs on to share as GUEST.

User5 and User6 have to logon to the server.... otherwise server doesn't know who is who.

 

[tobor8thman]

user5 and user6 .... hmmm are user5 and user6 real usernames on the machine that has folder 1-4? Are you really logging on with those names on that machine?

No, I am just using those names here in this forum as a simple way to illustrate the problem. The real user account names are much longer.

User accounts 5 and 6 are not on the same PC as the four folders. The PC which has folders 1-4 is a PC running Windows 8.0 Pro. User accounts 5 and 6 are on a separate networked PC in Workgroup running Windows 7.0 Professional.

 

[Kaktussoft]

User accounts 5 and 6 are not on the same PC as the four folders. The PC which has folders 1-4 is a PC running Windows 8.0 Pro. User accounts 5 and 6 are on a separate networked PC in Workgroup running Windows 7.0 Professional.

But how authenticates useraccount5 itself to the win8 pro share? Anonymous?

 

[Kaktussoft]

on win8 pro machine (with the user folder 1-4 shares) : Password Protected Sharing - Turn On or Off in Windows 8
Works?

 

[tobor8thman]

Go to Control Panel > Network and sharing center > Change advanced sharing settings > Enable Turn ON password protect sharing option

Turn it ON for your current profile, which is HOME I think(?) or was that setting already on? Was profile HOME? If setting is OFF ... nobody has to enter password and logs on to share as GUEST.

User5 and User6 have to logon to the server.... otherwise server doesn't know who is who.

Ok, I did all the above and I determined that user accounts 5 and 6 are logging on as Guests and not under their user account names, so your observation that the Win 8 Pro PC acting as server could not identify them was on target. I checked that users accounts 5 and 6 exist on the PC server running Win 8 Pro with the same password as they have on the Workgroup PC. I then turned on password protection on the Win 8 Pro PC (it was off, I thought it was on) and logged off user accounts 5 and 6 and then logged back on. Both accounts were denied access. I am not sure how to configure the share and NTFS permissions after that.

I did check Computer Management/Shared Folders/Sessions and Opened Files and only saw Administrator, Administrators and Homegroup listed.

 

[Kaktussoft]

useraccounts 1-4 can still access all you want?

user account 6 access denied. So logged on succesfully? Assume it's connected to usershare1. What are share permissions? What are NTFS permissions of that folder?

Try to logon with useraccount6 on win8 pro. Can it access usershare1 folder?

 

[Kaktussoft]

On #1 you see the shares are accessible by EVERYONE (FULL CONTROL). Also some extra permissions that are of no use. EVERYONE may everything.

The real protection will be done by NTFS. That's the normal way a system administrator manages it. For NTFS permissions....try to avoid explicit DENY permissions. DENY permissions are very difficult to manage.

 

[tobor8thman]

Whew! I think we are nearing the end and turning the corner. I have followed your guidance and made a chart/matrix so that everyone in the forum could easily follow. Can you tell me if this matrix which I included below looks like it would work. Please look first at the notes at the bottom of the matrix. The permissions settings for the "J" drive I believe are the default settings, so I didn't change those. I also deleted the "Parent" folder that you saw in #1 above.

I also don't understand what the difference is between "Administrators" and "Administrator." Thanks.

 

[Kaktussoft]

It looks like you shared the J drive and all its subfolders to EVERYONE. The NTFS permission of J root folder look like the default. It's just like they formatted a new local drive and use it. So EVERYONE can access J:\gfhnfgfghn\fdbdf\subfolder2 as well!

All Administrators on file server and HOMEGROUP can use the folder1-4 share. SYSTEM, Administrators, Administrator and HomeUsers have full control.

All Administrators on file server and EVERYONE can use the folder5 share. SYSTEM, Administrators, Administrator and HomeUsers and useracct6 have full control.

Administrators is a group and holds all accounts that have admin rights. Administrator is a real account .... the built-in admin account.

Why is whole J drive shared?

If PC1-4 is using USER6 ... it can still access folder5!

Is it working as expected now?

 

[tobor8thman]

Sorry, I have been away on business and could not work on the server for about a week.

J drive is no longer shared, and I put in all the changes you recommended, but at the end of the day I have to put "Everyone" in the permissions of each file (files 1-4) in order to give access to User Accounts 1-4 and 6 but when I do that, User Account 5 gains access too (which I don't want him to have) (see chart at #36 above). If I remove "Everyone" from the NTFS Permissions, then no one has access.

 

[Kaktussoft]

Sorry, I have been away on business and could not work on the server for about a week.

J drive is no longer shared, and I put in all the changes you recommended, but at the end of the day I have to put "Everyone" in the permissions of each file (files 1-4) in order to give access to User Accounts 1-4 and 6 but when I do that, User Account 5 gains access too (which I don't want him to have) (see chart at #36 above). If I remove "Everyone" from the NTFS Permissions, then no one has access.

Hoe is useraccount1 logging on? sure he doesn't appear as GUEST?

Logon as useraccount1 to server yourself interactively... can you access the folders and read/write?

 

[tobor8thman]

Sorry, I have been away on business and could not work on the server for about a week.

J drive is no longer shared, and I put in all the changes you recommended, but at the end of the day I have to put "Everyone" in the permissions of each file (files 1-4) in order to give access to User Accounts 1-4 and 6 but when I do that, User Account 5 gains access too (which I don't want him to have) (see chart at #36 above). If I remove "Everyone" from the NTFS Permissions, then no one has access.

Hoe is useraccount1 logging on? sure he doesn't appear as GUEST?

Logon as useraccount1 to server yourself interactively... can you access the folders and read/write?

I determined that the user accounts were not identified and were logging on as GUEST (see #33 above). But when I put password protected sharing on, it would not let them log on (again, see #33 above).

That's a good troubleshooting idea to try logging on with the user account on the remote PC, while you are at the remote PC . Maybe the problem is with the user account passwords not being similar. I will get back to you when I have a chance to test it.

Thanks for hanging in there!