Shared storage on Windows.
WHAT THE TWO PERMISSION SYSTEMS ARE
Share permissions, applying to network access File system permissions, applying always
WHAT THE EFFECTIVE PERMISSION IS
The more restrictive of the two.
WHAT THE CONVENTIONAL APPROACH IS
Share permissions permissive, file system permissions doing the actual work.
WHY
One system to reason about rather than two interacting.
WHAT TO ASSIGN PERMISSIONS TO
Groups, never individuals.
WHAT INHERITANCE MEANS
Permissions flowing down from a folder to its contents.
WHAT BREAKING IT CAUSES
Structures nobody can reason about.
WHAT TO DO INSTEAD
Design a structure where inheritance produces the right result.
WHAT TO AVOID
Deep folder structures with permissions at many levels Full control granted broadly Everyone having access as a shortcut
WHAT TO ENABLE
Auditing on sensitive locations Quotas, where storage must be controlled Previous versions, so users can recover their own files
WHY THAT LAST ONE
It removes a substantial proportion of restore requests.
WHAT TO DOCUMENT
The permission structure.
WHAT TO REVIEW
Who has access to sensitive locations.
