Dealling With Inheritiable Permissions

Question:

Quick question, I seem to of forgotten the correct syntax to delegate permissions on Folder structure!
I seem to recall it goes something like.
AddExtender("WWWNT34i.DLL") wntAccessAdd("", "C:\Documents and Settings\TEST ", "builtin\users", 300, "Dir:Modify")
Example:

C:\Documents and Settings\TEST (Read Access)
C:\Documents and Settings\TEST\Programs (Read Access)
C:\Documents and Settings\TEST\Programs\Lab (Deny access � List folder contents � also write access
but is there an easier way rather than having to add a line for each individual folder?

Answer:

When you use the word "delegate", are you referring to inheritiable permissions? If so, then by default, on Win2K & newer, the permissions specified by pre-defined access strings such as "Dir:Modify" will be inherited by all child folders & files below the folder to which those permissions are explicitly applied. The only exception to this is if the child folder or file has ACL inheritance disabled for the DACL [a.k.a. the permissions list].

For the folder hierarchy that you've desribed above, the access-allowed permissions will inherit down automatically to "programs" and "programs\lab". To restrict access to "lab", you have 2 choices. The 1st is to disable inheritance on it [via wntAccessMod() or via the security properties tab in Explorer] and assign explicit permissions, or, simply make an explicit assigment of access-denied permissions on the "lab" folder. When there's a combination of access-allowed & access-denied permissions, the access-denied permissions take priority when calculating effective permissions and so the access-allowed permissions that were inherited will be meaningless on the "lab" folder.

Article ID:   W17054

File Created: 2007:07:03:14:28:02

Last Updated: 2007:07:03:14:28:02

Database Search

TechHome