SBS 2008 file permissions error applying security - access denied

[heals1ic]

While logged into my sbs 2008 using the domain administrator account I keep getting this error when changing folder security to folders and children.

error applying security
An error occurred while applying security information to:
c:\folder\file.doc
access denied

All of the files and subfolders in this folder have full permissions for the administrator account but some files still refuse to allow permission changes inherited from the parent folder. I can however change these files individual permissions without this error occurring.

Any idea how I can change folder and file permissions without having to apply to individual files (there are many files and folders to change)?

[jlego]

Try subinacl

Try using subinacl: http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en

subinacl /applyonly=own /subdirectories "c:\users\admin"

You might also try cacls

cacls "C:\users\Admin" /t /c /g Everyone:F

do this in safe mode''

[heals1ic]

I have tried subinacl and I get the same result permission denied.

Some more background -

I have changed the owner of the parent folder to the administrators group and then attempted to change the permissions of the children under it but I get he same problem – access denied

The files that are causing the issue seem to have -

SYSTEM account – full permission
Administrators group – full permission
Users group – read & execute and read checked

As soon as I individually adjust the Users group permissions to Full Control on that file the parent permission changes now propagate (inherited groups are added and permissions are granted)

It's got me baffled??

[jlego]

got me baffled as well. i will do some research if i get a chance but i am pretty busy at the current moment - in the meantime maybe someone else can answer this one.

[heals1ic]

I did have some success with cacls but only adding a user with full permissions.

Still could not get domain\users to have full control on all files propagated from the parent folder.

Still get permission denied on some files for that.

[jlego]

try this just as a test..

create a new security group (in active directory)
name it test or something
add a few users to it
give the group full access permisions in the parent folder

see if one of the users still has issues

[jlego]

also.. are you giving everyone access to the folder?

[heals1ic]

Yeah I have tried that and the applied permissions for domain\users but some files seem to be blocking the propagation of this change with permission denied.

If I change the domain\users permission on one of the problem files individually it will allow the change and then propagate the extra group (in this case 'test' group) and it's permissions to that file automatically.

I am attempting to give the group domain\users full access to the files and subfolders.

It's almost as if some files don't recognise the domain\admin status of my login when I make folder based permission changes but it does when dealing with the file individually. Once the domain\users permission is changed it opens the flood gates with all the permissions waiting to be propagated.

It's just weird.

[jlego]

i had a similiar situation before. the company i work for was previously setup by someone i never ment. the domain controller hosted all the file sharing, and for some reason even the admin account could not make changes to the shares.

unfortunatily, the way i fixed it was upgrading to server 2008, which isn't an option for you.

after googling the only thing i could find was a situation similiar in vista. the user turned UAC off for a few minutes and was able to make the changes he needed.

hopefully someone else on her might know the reasoning. sorry i could'nt help.

[heals1ic]

Thanks for your feedback anyway Jeff

[Johnclave111]

thanks for sharing and discuss this information. its quit interesting to get information which is very useful but we don't know.

[jlego]

did you ever resolve this? Im interested to know what the solution was

[ComputerCharmer]

A cheat I have found for getting around any permissions errors are to go the root of the drive and take ownership. Take the option to include containing and sub folders. Good luck