Windows 10: User's permission from ACL setting

Hi,

I am studying DACL and I have a question. Could someone help to explain? Thank you.

I set DACL of a foler for a user as below,



"g3" is a group of "u3. By this setting, I could use "u3" to access this folder, and in this folder, I could not create any new file/folder, but I can deleted existing file/folder. And if there was no ACE for "g3", I could not create new file/folder and also could not delete existing file/folder. Why?


Thank you.

Elika

:)

 

KB3152599 - Device Access Broker ACL Update for Win10 Version 1511

Only a idea:
An access control list (ACL), with respect to a computer file system, is a list of permissions attached to an object. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects. Each entry in a typical ACL specifies a subject and an operation. For instance, if a file object has an ACL that contains (Alice: read,write; Bob: read), this would give Alice permission to read and write the file and Bob to only read it.

 

Windows Folder Redirection, setting permissions with windows ACL

I'm relatively new to Windows server management. I'm trying to setup folder redirection with GPO. The file server that's getting redirected is in a LXD fedora container.

for the most part I've been following the configuration from wiki.samba.org:

https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member

https://wiki.samba.org/index.php/User_Home_Folders

https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs

The problem that I'm having is setting the folder shares permissions in windows server 2016. when I try to modify the Permissions for my share folder in order to give Domain Users access I get:





The same thing happens when I try to change owner or disabling inheritance.

Another interesting note is when I connect to the share server with Computer management I get this when I try to expand System Tools:





After you hit OK, it proceeds to connect and I can access the shares. There is no firewall set on the file share server, but this may help figure out what going on.

I'm pretty sure this is a problem with ACL either on the windows or linux side.

while testing ACL support in my container, when I run the security test I get this:

# setfattr -n security.test -v test2 test.txt

setfattr: test.txt: Operation not permitted

To me this indicates a problem with ACL on the smb share filesystem, but again I'm relatively new to windows server management. If there are any steps to go through trouble shooting this on the windows side of things it'd be much appreciated.

Thanks again!

 

How to use powershell and set-acl to replicate permissions across folder structure and for specific extensions?

There are a set of folders and subfolders in windows containing *.dxf (many), *.add (many) and shapes.dat (1 per folder) files. These are part of a folder structure required by a software.

I need to recursively set permisions for all *.dxf and *.add to read-only while leaving individual shapes.dat files with write permission.

In the follwing link something is described that seems to help, but I see no way to refactor no enable my operation.

The commands suggested are:

I have also found a couple related questions: I've tried solving this with limited success (having to delete and restore from backup).

• Link 1
  
• Link 2
  

Any attempt will be appreciated.