Well, with security its kind of hard to know sometimes what in the hell you actually FUBAR, short of making the mistake and learning the hard way. If you are dealing with the Local Security Policy at all, those don't take effect until you reboot. A little primer on file system security in windows:
There are two basic types of security in Windows NT based systems: folder and share.
SHARE: When you share a folder the first thing you access when you try to view it across the network is the share level security. This is set to the EVERYONE group (wide open) by default. If you remove the everyone group and then specify another group to allow access to your share it will block anyone that is not a member of that group from accessing the share. Once they authenticate with that share however, there is nothing further that share security can do for you. Think of it simply as a wall: once by, nothing stops you.
FOLDER: With folder security (only available in NTFS) you can specify what a user can or cannot do. If you click on the security tab of any folder's properties you will see two columns of boxes and rows of security options. It can get complicated, but its worth figuring it out. One thing to remember is that DENY permissions overrule allow permissions.
The main idea is to set the default permissions that most everybody would need to have to allow, starting at the root of the share. This makes it easy since the folders by default enherit their settings from the folder directly above. Once you get down into a folder that you want just one user to be able to use, you can uncheck the inherit folder permission and then delete out or simply deny any user or group the access to that folder.
ONE SIDE ISSUE: There is a setting in the secpol.msc template (local security settings in administrative tools, control panel) that reads something like "bypass traverse checking". What this setting allows a user to do is to step over a folder, even if you deny them access to that folder, and look into folders below it if they have permission. By default the EVERYONE user is in there so you will have to remove it if you want to make your system a bit more secure.
Be really careful with SECPOL.MSC, aka Local Security Settings, and in particular the Deny Logon Locally setting. This doesn't mean you are giving somebody permission to specify who can log onto your computer. This is actually a list of users who CANNOT log on locally. I had a guy punch in Administrator as a user in this field, and reboot the computer. The result is a format and reinstall. This setting forbid the administrator from even logging into the recovery console.
Facebook
Twitter