Specific folder permission only?

Hello, when creating a new windows domain user in active directory is there
a way to grant this new user account access to one specific folder only
and/or remove them or re-assign them from the default 'Domain Users' group
to another Primary Group?

Thanks in advance.

Hello 7777,

Yes you can grant to a specific folder by going to that folder security
settings and add user in question. You can remove user from Default Domain
Users group but you must assign user to a new group and mark as the primary
group because the Domain Users group by default is set as the primary
group..But I will not advice you to remove user from the Domain Users
group... What exactly are you trying to achieve?

--
Isaac Oben [MCTIP:EA, MCSE]
"7777" <NoSpam@NoSpam.com> wrote in message
news:OuF$Lpa2JHA.4632@TK2MSFTNGP02.phx.gbl...
> Hello, when creating a new windows domain user in active directory is
> there a way to grant this new user account access to one specific folder
> only and/or remove them or re-assign them from the default 'Domain Users'
> group to another Primary Group?
>
> Thanks in advance.
>

Thanks Isaac for your speedy reply, I totally appreciate it. I guess I'm
aiming to have a specific user to access only 1 folder that's within our
domain and just wanted to make sure this user doesn't have access to any
other folders/directories on our domain. Networking isn't my expertise so I
wasn't sure what the default permissions and folder rights that the Domain
Users group has or the supposed direction to go. Would the Domain Guests be
another route to take or what is the difference between those?...do both of
these groups have no rights/permissions by default which appears would be
good as my initial novice guesstimate?



"Isaac Oben [MCITP,MCSE]" <isaac.oben@nospam.gmail.com> wrote in message
news:C07DD9F9-F562-4A58-8BB3-7FFB248F8111@microsoft.com...
> Hello 7777,
>
> Yes you can grant to a specific folder by going to that folder security
> settings and add user in question. You can remove user from Default Domain
> Users group but you must assign user to a new group and mark as the
> primary group because the Domain Users group by default is set as the
> primary group..But I will not advice you to remove user from the Domain
> Users group... What exactly are you trying to achieve?
>
> --
> Isaac Oben [MCTIP:EA, MCSE]
> "7777" <NoSpam@NoSpam.com> wrote in message
> news:OuF$Lpa2JHA.4632@TK2MSFTNGP02.phx.gbl...
>> Hello, when creating a new windows domain user in active directory is
>> there a way to grant this new user account access to one specific folder
>> only and/or remove them or re-assign them from the default 'Domain Users'
>> group to another Primary Group?
>>
>> Thanks in advance.
>>
>

Hello 7777,

When you have shares for your users or branches etc. configured, you should
create your own security groups to configure NTFS permissions on the folders
that fit for your needs. Do not work with "Everyone" or "Authenticated users"
group when not all domain members should have access. That way you can prevent
easy one account from accessing other folders and only give it the needed
permissions.

Also do not use the domain guest group or the guest account. Domain guests
have the same permissions as the domain users. Only the guest account is
further restricted and disabled by default.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Thanks Isaac for your speedy reply, I totally appreciate it. I guess
> I'm aiming to have a specific user to access only 1 folder that's
> within our domain and just wanted to make sure this user doesn't have
> access to any other folders/directories on our domain. Networking
> isn't my expertise so I wasn't sure what the default permissions and
> folder rights that the Domain Users group has or the supposed
> direction to go. Would the Domain Guests be another route to take or
> what is the difference between those?...do both of these groups have
> no rights/permissions by default which appears would be good as my
> initial novice guesstimate?
>
> "Isaac Oben [MCITP,MCSE]" <isaac.oben@nospam.gmail.com> wrote in
> message news:C07DD9F9-F562-4A58-8BB3-7FFB248F8111@microsoft.com...
>
>> Hello 7777,
>>
>> Yes you can grant to a specific folder by going to that folder
>> security settings and add user in question. You can remove user from
>> Default Domain Users group but you must assign user to a new group
>> and mark as the primary group because the Domain Users group by
>> default is set as the primary group..But I will not advice you to
>> remove user from the Domain Users group... What exactly are you
>> trying to achieve?
>>
>> --
>> Isaac Oben [MCTIP:EA, MCSE]
>> "7777" <NoSpam@NoSpam.com> wrote in message
>> news:OuF$Lpa2JHA.4632@TK2MSFTNGP02.phx.gbl...
>>> Hello, when creating a new windows domain user in active directory
>>> is there a way to grant this new user account access to one specific
>>> folder only and/or remove them or re-assign them from the default
>>> 'Domain Users' group to another Primary Group?
>>>
>>> Thanks in advance.
>>>

Thanks for your informative reply Meinolf, much appreciated as well. So in
choosing the least privileged way which account or group would one create a
user for a particular domain?


"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
news:ff16fb6624b9e8cba87d1fff3750@msnews.microsoft.com...
> Hello 7777,
>
> When you have shares for your users or branches etc. configured, you
> should create your own security groups to configure NTFS permissions on
> the folders that fit for your needs. Do not work with "Everyone" or
> "Authenticated users" group when not all domain members should have
> access. That way you can prevent easy one account from accessing other
> folders and only give it the needed permissions.
>
> Also do not use the domain guest group or the guest account. Domain guests
> have the same permissions as the domain users. Only the guest account is
> further restricted and disabled by default.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Thanks Isaac for your speedy reply, I totally appreciate it. I guess
>> I'm aiming to have a specific user to access only 1 folder that's
>> within our domain and just wanted to make sure this user doesn't have
>> access to any other folders/directories on our domain. Networking
>> isn't my expertise so I wasn't sure what the default permissions and
>> folder rights that the Domain Users group has or the supposed
>> direction to go. Would the Domain Guests be another route to take or
>> what is the difference between those?...do both of these groups have
>> no rights/permissions by default which appears would be good as my
>> initial novice guesstimate?
>>
>> "Isaac Oben [MCITP,MCSE]" <isaac.oben@nospam.gmail.com> wrote in
>> message news:C07DD9F9-F562-4A58-8BB3-7FFB248F8111@microsoft.com...
>>
>>> Hello 7777,
>>>
>>> Yes you can grant to a specific folder by going to that folder
>>> security settings and add user in question. You can remove user from
>>> Default Domain Users group but you must assign user to a new group
>>> and mark as the primary group because the Domain Users group by
>>> default is set as the primary group..But I will not advice you to
>>> remove user from the Domain Users group... What exactly are you
>>> trying to achieve?
>>>
>>> --
>>> Isaac Oben [MCTIP:EA, MCSE]
>>> "7777" <NoSpam@NoSpam.com> wrote in message
>>> news:OuF$Lpa2JHA.4632@TK2MSFTNGP02.phx.gbl...
>>>> Hello, when creating a new windows domain user in active directory
>>>> is there a way to grant this new user account access to one specific
>>>> folder only and/or remove them or re-assign them from the default
>>>> 'Domain Users' group to another Primary Group?
>>>>
>>>> Thanks in advance.
>>>>
>
>

Hello 7777,

Create a domain user account and configure security groups instead of using
the default ones. That's the "normal" way.

Also see here about:
http://technet.microsoft.com/en-us/l.../bb727008.aspx

http://technet.microsoft.com/en-us/l...94(WS.10).aspx

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Thanks for your informative reply Meinolf, much appreciated as well.
> So in choosing the least privileged way which account or group would
> one create a user for a particular domain?
>
> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
> news:ff16fb6624b9e8cba87d1fff3750@msnews.microsoft.com...
>
>> Hello 7777,
>>
>> When you have shares for your users or branches etc. configured, you
>> should create your own security groups to configure NTFS permissions
>> on the folders that fit for your needs. Do not work with "Everyone"
>> or "Authenticated users" group when not all domain members should
>> have access. That way you can prevent easy one account from accessing
>> other folders and only give it the needed permissions.
>>
>> Also do not use the domain guest group or the guest account. Domain
>> guests have the same permissions as the domain users. Only the guest
>> account is further restricted and disabled by default.
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> Thanks Isaac for your speedy reply, I totally appreciate it. I
>>> guess I'm aiming to have a specific user to access only 1 folder
>>> that's within our domain and just wanted to make sure this user
>>> doesn't have access to any other folders/directories on our domain.
>>> Networking isn't my expertise so I wasn't sure what the default
>>> permissions and folder rights that the Domain Users group has or the
>>> supposed direction to go. Would the Domain Guests be another route
>>> to take or what is the difference between those?...do both of these
>>> groups have no rights/permissions by default which appears would be
>>> good as my initial novice guesstimate?
>>>
>>> "Isaac Oben [MCITP,MCSE]" <isaac.oben@nospam.gmail.com> wrote in
>>> message news:C07DD9F9-F562-4A58-8BB3-7FFB248F8111@microsoft.com...
>>>
>>>> Hello 7777,
>>>>
>>>> Yes you can grant to a specific folder by going to that folder
>>>> security settings and add user in question. You can remove user
>>>> from Default Domain Users group but you must assign user to a new
>>>> group and mark as the primary group because the Domain Users group
>>>> by default is set as the primary group..But I will not advice you
>>>> to remove user from the Domain Users group... What exactly are you
>>>> trying to achieve?
>>>>
>>>> --
>>>> Isaac Oben [MCTIP:EA, MCSE]
>>>> "7777" <NoSpam@NoSpam.com> wrote in message
>>>> news:OuF$Lpa2JHA.4632@TK2MSFTNGP02.phx.gbl...
>>>>> Hello, when creating a new windows domain user in active directory
>>>>> is there a way to grant this new user account access to one
>>>>> specific folder only and/or remove them or re-assign them from the
>>>>> default 'Domain Users' group to another Primary Group?
>>>>>
>>>>> Thanks in advance.
>>>>>