Users suddenly losing access rights to folders on public drive???

[Mizugori]

Lately, users are frequently complaining that when they try to save changes to an existing document they have worked on before, they get an access denied error. It also sometimes happens when they try to create new documents and save them in folders where they have previously had full rights.

The folders in question are in a directory like this:

Z:\Public\Client Documents

and there are many folders (probably about fifty) within the "Client Documents" folder.

Any ideas on why this is happening? So far when a user reports this, I go to the folder in question

(say for example Z:\Public\Client Documents\JoeSmith)

and I go to the security tab, and check "full control" for 'employees' (a group everyone here belongs to). This resolves the issue but then it keeps happening with different folders. I am not sure if something happened that screwed up the permissions ages ago and it is just only revealing itself as people try to go into different folders which haven't been accessed in a while, or if it is a constantly occurring thing and folders keep randomly changing privileges.

If anyone can help me figure this out, I'd really appreciate it.

Thanks!
Edit/Delete Message

 

[MadRat]

Visit http://wwwthep.physik.uni-main...rink/chown/readme.html and try their chown the entire contents and set ownership to your domain admins group, then reapply the rights you desire to it.

Or find an NT resource kit and use setacls to set it. I personally like the chown utility for its simplicity.

 

[RebateMonger]

Originally posted by: Mizugori
and I go to the security tab, and check "full control" for 'employees' (a group everyone here belongs to)

I suggest that everyone doesn't need "full control" of Security attributes, allowing everyone to change the Security rights as they desire.

"Maximum" settings for a network share that everyone uses would normally be:
Sharing ----- "Everyone" - "Full Control"
Security ----- "(Users)" - "Modify"

I am not sure if something happened that screwed up the permissions ages ago and it is just only revealing itself as people try to go into different folders which haven't been accessed in a while, or if it is a constantly occurring thing and folders keep randomly changing privileges.

This would seem to be something you need to determine. It's one thing to make a one-time change to the folder permissions to correct an earlier problem, and a completely different problem to determine why your system is randomly changing folder permissions.

Microsoft offers "AccessEnum" to view your file system settings. You can select a higher-level folder and AccessEnum will show you all folders beneath it that have different Read or Write permissions than the upper-level folder. You can save the list and compare it to a later list to see what's changed.

 

[MadRat]

I missed the part about "full control" rights being given to everyone. If a person in a higher level group creates a folder then the files within that folder will be both owned by them and the inherited rights from that group or any group policy they lie within will also apply to that folder. You are best to give read/write permissions to the folder but do not give full control as that implies all sorts of subtle nuances with group rights and policies. The "most restrictive" nature of Microsoft can be really cryptic in these regards.