RE: Share and NTFS permissions

One way you can set custom permissions on new files is to use the file
screens feature in Win2003 R2. You could create a file screen for all new
files, have that screen run a script and that script can set permissions and
can be as elaborate as you want. 

Of course, this does introduce a bit of a race condition but that would only
be for the creator/owner. It may not work for every situation. 

I mentioned this technique recently in my blog:
http://xato.net/bl/2007/02/01/using-filescreens-for-server-lockdowns/



Mark Burnett



-----Original Message-----
From: David LeBlanc [mailto:dleblanc@mindspring.com] 
Sent: Monday, February 05, 2007 10:31 AM
To: 'De Rienzo, James'; 'M. Burnett'; 'Jim Harrison';
Monrad.DC@Forces.gc.ca; focus-ms@securityfocus.com
Subject: RE: Share and NTFS permissions

 

> -----Original Message-----
> From: De Rienzo, James [mailto:James.DeRienzo@hq.doe.gov] 
> Sent: Monday, February 05, 2007 7:34 AM
> To: David LeBlanc; M. Burnett; Jim Harrison; 
> Monrad.DC@Forces.gc.ca; focus-ms@securityfocus.com
> Subject: RE: Share and NTFS permissions
>
> Change the file's Ownership to Administrator, and be done with it. 
>
> Simple yet effective.

And have the likely side-effect of removing access from the original owner.
I'd suggest taking a more thorough approach. This is why I originally wrote:

"it takes ownership of anything showing up there, ****and sets an ACL the
admin finds appropriate****"