Skip

How to ensure documents moved to a shared folder have the same permissions as documents created in the shared folder?
February 23, 2011 10:11 AM   Subscribe

Looking for a setting in Windows XP to ensure that all users (or all users in a certain group) will always be able to access documents in a shared folder.

At work there is a computer which many people use. They have to share resources that are stored in a certain user's my documents folder. The other users all have their own Windows XP logins, and have been granted access to the communal my documents folder.

Here's the problem: if a user creates a file outside the shared folder and then moves or copies the file into the shared folder, the file "remembers" who its owner is. The other users cannot access the file unless it is created within the shared folder initially.

Is there a way to specify to windows that any file placed in the shared folder, regardless of its original permisisons, must be able to be read by anyone within the group?

There are a lot of constraints involved regarding what is possible to do and what is not, so the best answers would be ones that focus on tools and resources built into Windows XP.
posted by jsturgill to Computers & Internet (13 answers total)
 
Rather than have that folder within a particular user's profile, can you just put it in the C root?
posted by Burhanistan at 10:13 AM on February 23, 2011


It sounds like your permissions are set incorrectly. The default folder permissions should apply to files created inside the folder. This KB article explains it in more detail. Check to be sure that the My Documents folder permissions scope is set to This Folder, Subfolders, and Files and not something like This Folder.
posted by odinsdream at 10:19 AM on February 23, 2011


The default folder permissions should apply to files created inside the folder.

My understanding is that the permissions hold for things that are created inside the folder (i.e., save as -> shared folder\file.name), but the loose permissions aren't added to files created outside the folder (with stricter permissions) and then moved there (cut or copy and paste, dragged and dropped, moved).
posted by jsturgill at 10:25 AM on February 23, 2011


Perhaps remove the "Set Permissions" option on the My Documents directory so that the copy routine is forced to take the parent permissions, rather than set more restrictive ones.
posted by odinsdream at 10:34 AM on February 23, 2011


Odinsdream, could you maybe provide a link or specify a chain of actions to get me to that option? Or link to a KB?

(like, right click on directory -> select properties -> select security tab -> click advanced button -> etc....)
posted by jsturgill at 11:18 AM on February 23, 2011


Unfortunately I'm not going to be able to access the computer for a few days, so I can't try things out right away and report success or not success. (FYI)
posted by jsturgill at 11:18 AM on February 23, 2011


jsturgill has it.

A copy will make a copy of the file and that will inherit the permissions of the folder to which the copy is placed.

A move just changes the MFT record (think index) but makes no changes to the file itself, including the permissions.

This only applies if the source and destination are on the same physical disk (in which case "move" is the default action with drag'n'drop). If they are on different disks, then a move becomes "copy then delete" and the copy rules apply.

The owner will remain the account that created the file initially, unless explicitly changed.

Have your users copy files, then delete the source, rather than move. If they do move, they will have to update the permissions on the file from the security tab. I don't have any XP machines to hand, but there's something along the lines of "inherit permissions of parent folder"
posted by nicktf at 11:44 AM on February 23, 2011


jsturgill: From the folder's properties, go to Security tab, click the Advanced button. This takes you to a Permissions tab showing the settings per group or user. The Apply To column should say This folder, subfolders, and files for all rows.

Double-click the group that includes the users who are doing the copy/move operations, then un-check Change Permissions and Take Ownership.
posted by odinsdream at 12:15 PM on February 23, 2011


You're sharing a person's My Documents folder? It's probably inheriting from that user's parent directory.

Create a separate directory that you want everybody to have permissions on and put the stuff in that. If you don't think everybody can handle the whole C: drive thing or a shortcut, you can change every user's My Documents to point to it (My Docuemnts -> right-click -> Properties).
posted by rhizome at 2:21 PM on February 23, 2011


A separate directory outside of \Documents & Settings or \Users, like C:\Shared.
posted by rhizome at 2:22 PM on February 23, 2011


I recreated the problem with a different machine that I do have access to right now. It appears as though it can be fixed by the owner of the file doing the following:

right click -> security -> advanced -> check "Inherit from parent the permission entries that apply to child objects. Include these with entries explicitly defined here."

The users in this case are not particularly tech saavy, and it's unreasonable to expect them to police themselves as they add files to this shared document.

Is there a setting that can be changed to make it default for windows group members to have that checkbox set for all files they create? It appears that doing so would resolve the issue.

Note that I believe the problem would exist even if the directory were changed to one outside of the users directory. Permissions are set properly for the folder (I believe). The problem is that permissions for moved files are not being updated when they are moved to the shared directory because by default, files appear to not have the checked box mentioned above selected.
posted by jsturgill at 2:37 PM on February 23, 2011


"for windows group members" means users in a particular group, not members of a group called windows.
posted by jsturgill at 2:38 PM on February 23, 2011


...And further playing around reveals that checking that box is the default on the machine I do have access to. I'll have to experiment when I can access the problem machine.

Information on how to control that setting on a group level would be great. Also if there is a method to force it on all files coming into a directory and its subdirectories.
posted by jsturgill at 2:49 PM on February 23, 2011


« Older After a lifetime of indifferen...   |  Help me name that tune!... Newer »
This thread is closed to new comments.


Post