Deny specific user

zz12

Hello. Is there a way to deny a specific domain user on folders and
subfolders on a w2k server active directory? Just wondering if it was
possible to leave the Everyone group access to a folder but somehow deny 1
specific user at the same time.

Thanks in advance.

Paul Adare

On Wed, 5 Dec 2007 17:30:26 -0800, zz12 wrote:

> Hello. Is there a way to deny a specific domain user on folders and
> subfolders on a w2k server active directory? Just wondering if it was
> possible to leave the Everyone group access to a folder but somehow deny 1
> specific user at the same time.

A DENY access control entry (ACE) takes precedence over an ALLOW ACE so
yes, you should be able to do what you're trying to do.

--
Paul Adare
MVP - Virtual Machines
http://www.identit.ca
You know it is going to be a bad day when you forget your new password.

Roger Abell [MVP]

The filesystem folder ? or one seen viewing active directory ?

An explicit deny overrules any grant, which is effective for the object
itself.
But such a deny is only potentially effective on any sibling dependent
content if the object is a container like a directory. Where the deny is
only inherited, any grant to the principal that is nearer the object than
the inheritance point of the deny will overrule the deny.

So, there is a simple (for filesystem at least) way to do what you are
after, if anything inheriting permissions from where you place the deny has
nothing but those inherited permissions (or only differences knowing made).

Roger

"zz12" <IDontLikeSpam@Nowhere.com> wrote in message
news:O75kcf6NIHA.2140@TK2MSFTNGP03.phx.gbl...
> Hello. Is there a way to deny a specific domain user on folders and
> subfolders on a w2k server active directory? Just wondering if it was
> possible to leave the Everyone group access to a folder but somehow deny 1
> specific user at the same time.
>
> Thanks in advance.
>

zz12

If I go ahead and issue a Deny on a specific domain regular user to a one of
our server's 'c' drive this would basically deny access to this particular
server's entrie 'c' drive. Say later on I then uncheck the Deny permission
for this user in theory it would just affect this particular regular user in
where if we deleted this domain user then everything should be back to
original and not effect any other user's permissions on the server's 'c'
drive?


"Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
news:ewW9LMKOIHA.1188@TK2MSFTNGP04.phx.gbl...
> The filesystem folder ? or one seen viewing active directory ?
>
> An explicit deny overrules any grant, which is effective for the object
> itself.
> But such a deny is only potentially effective on any sibling dependent
> content if the object is a container like a directory. Where the deny is
> only inherited, any grant to the principal that is nearer the object than
> the inheritance point of the deny will overrule the deny.
>
> So, there is a simple (for filesystem at least) way to do what you are
> after, if anything inheriting permissions from where you place the deny
> has nothing but those inherited permissions (or only differences knowing
> made).
>
> Roger
>
> "zz12" <IDontLikeSpam@Nowhere.com> wrote in message
> news:O75kcf6NIHA.2140@TK2MSFTNGP03.phx.gbl...
>> Hello. Is there a way to deny a specific domain user on folders and
>> subfolders on a w2k server active directory? Just wondering if it was
>> possible to leave the Everyone group access to a folder but somehow deny
>> 1 specific user at the same time.
>>
>> Thanks in advance.
>>
>
>