File Permissions on NTFS

Question

File Permissions on NTFS

Hi,

So I noticed that after installing Snow Leopard, when a user writes a file to a shared folder on a NTFS permission structure, no other user on my network can access that file.

When I was on Leopard a user could copy over a file and the file would respect my parent permissions on the NTFS share so other users could access.

What happened w/ Snow Leopard? This is causing a major problem at work. Has anyone else experienced this?

Michael

Mac OS X (10.6)

Posted on Sep 22, 2009 5:01 PM

Reply

Answer 1

Sep 22, 2009 5:08 PM in response to michaelatblitz

I do not understand.
Where does your NTFS shared drive is physically located ?
Do you share a drive formatted with ntfs on your mac using ntfs3g ( that would be a crazy idea) ?
Is the drive connected to a Windows Server or a Windows Workstation ?

Reply

Answer 2

Sep 22, 2009 5:26 PM in response to nobody loopback

I have a DAS connected to a Win2k3 box. I'm sharing a folder called "projects" on that DAS through Win2k3.

Here are the NTFS perms on the projects folder:
Domain Users - Modify
Domain Admins - Full Access

Now, on Snow Leopard when I copy a file into the projects folder the NTFS permissions now look like:
Michael - Full Access
Domain Admins - Full Access

It drops my Domain Users so no one can access it.

When copying from Leopard, the projects folder looks like:
Domain Users - Modify
Michael - Full Access
Domain Admins - Full Access

Why when I copy over from Snow Leopard do I lose Domain Users? The projects folder is grabbing its permissions from the parent folder which has:
Domain Users - Modify
Domain Admins - Full Access

Does that make better sense?

Message was edited by: michaelatblitz

Reply

Answer 3

Sep 22, 2009 5:35 PM in response to michaelatblitz

Is your Account "michael" a member of the Domain admins group ?
if yes, remove it from this group (it is not good to do normal work as a domain admin)

If this is not the case,
in the windows Servers properties of the folder:
try, under "security",
remove "full control" from the "CREATOR OWNER" user, or, remove the "CREATOR OWNER" security permissions from this folder.
so that:
system administrators have: full control
domain users: read, write, modify
system: full control

does that fix it ?

Reply

Answer 4

Sep 22, 2009 5:43 PM in response to nobody loopback

Michael is a Domain User.

Yes removing the CREATOR OWNER solved the problem. Strange, any ideas why this would happen in Snow Leopard and not Leopard?

Seems like a major problem if I want the CREATOR OWNER to be able to modify permissions on their own file.

Reply

Answer 5

Sep 22, 2009 5:51 PM in response to michaelatblitz

Apple has obviously changed some defaults of the smb client in 10.6 without putting a warning label on the DVD box.
Another example:
http://discussions.apple.com/message.jspa?messageID=10191802#10191802

The OS defaults when you create a file on your disk, to:
owner: read/write
group: (only the user is member of this group): read
anyone else: no permissions

Now, if you create a file on a network share, these permissions will also be in effect ( this will happen on windows systems too).
Therefore you have to remove Full Control from the CREATOR OWNER.

Reply

Answer 6

Sep 22, 2009 5:54 PM in response to nobody loopback

I'm going to do some more testing and see if that solved the problem. Thanks for the help and re-confirming to me why Mac in a Windows environment can be a pain in the butt. 🙂

Reply

Answer 7

Sep 22, 2009 6:00 PM in response to michaelatblitz

"Seems like a major problem if I want the CREATOR OWNER to be able to modify permissions on their own file."

That makes no sense to me. If you need a folder shared read/write for a group, nobody should be able to set permissions other then the administrator (!?)

Reply

Answer 8

Sep 22, 2009 6:17 PM in response to nobody loopback

Okay what if I set a folder to be Domain Users read/write only but the CREATOR OWNER can delete files they've created. How would I setup the perms?

Message was edited by: michaelatblitz

Reply

Answer 9

Sep 22, 2009 6:28 PM in response to michaelatblitz

I have not tried this.

If the user is member of the domain users group, he is not able to create a file. therefore, he cannot set permissions to a file.

you can allow the domain user to "Create files/Write data", "Create Folders/Append data", "delete"
Then, he can create a file. Other users will be able to read - but not delete.

do you need some structure like for a roaming user profile ?
http://technet.microsoft.com/en-us/library/cc757013(WS.10).aspx

Reply

Answer 10

Sep 22, 2009 6:30 PM in response to nobody loopback

If I was in a Windows environment I would set permissions like this:
Domain Users Read & Write
CREATOR Modify

However, if a Snow Leopard user copied over a file it would change the permissions to CREATOR Modify and that's it.

In Leopard it would keep my permissions. See the problem?

Reply

Answer 11

Sep 23, 2009 9:35 AM in response to michaelatblitz

Shouldnt that work with:
Domain users: read/write/create/append/change
And: creator owner: delete

?

I never had this kind of problem. But if I have vom spare time, i try that out.

Reply