MCSE - silly question maybe

  Toffly 23:56 12 Jun 2007

Hi guys,

I'm currently reading through MCSE for 2000 pro to get a base understanding before buying the 2003 and books.

Anyway, I'm just in the printer section, and am a little bit confused about rights.

Basically, at the top of the page, it says;

"Denied permissions always override allowed permissions. For example, if you select the Deny check box next to Manage Documents for the Everyone group, no one can manage documents"

Further down the page, it then says;

"By default, Windows 2000 assigns the Printer permission for each printer to the built in everyone group"

Now, forgive me if I'm being stupid, but surely that would mean to allow anything beyond the default "Print" permission, I would need to allow everything in the everyone group, and then deny the other permissions on a per group basis? As oppose to just allowing extra permissions on certain groups?

For example, using the default set up, if I change the permission in say, the "development" group to allow some more permissions, then the deny in the "everyone" group would override these allows?

To beat this, I would need to make the allows in the everyone group, and then go through all the other groups and deny the extra permissions.

I may have this all wrong, but am a little confused, so it would be much appreciated if anyone can help me out here!

Thanks in advance


  joe11ee 05:29 13 Jun 2007

"totally vote for you, thanks for the post."

click here

  P1d 09:50 13 Jun 2007

I was always told that Deny overwrites everything. Using Deny permissions can cause all sorts of problems and was always recommended to not use Deny.

  recap 14:23 13 Jun 2007

When setting Print Permissions the 'Everyone Group' should be removed, then you can Add any Group or User and set the permissions for these from the Security tab.

Here at work we have two network printers, one for the main office and the other for the IT Centre. I have set permissions for each group and removed the 'Everyone Group'. If I kept the 'Everyone Group' users in the IT Centre would be able to print to the Office printer. I have added permissions to the Office Group to Print to IT Centre printer just in case there are any problems in the Office.

I have set different Print permissioins for both Groups, with the Office they can Print/Manage Printers/Manage Documents. In the IT Centre they can only Print a document.

So by removing the 'Everyone Group' I can set the permissions as I require.

  Toffly 21:28 13 Jun 2007

Never realised that the everyone group could be removed, by the way the book put it, it sounded like an inbuilt group that couldn't be removed.

Thanks guy!

  recap 09:03 14 Jun 2007

The 'Everyone Group' can be removed from any security option whether it be the Domain Security Policy right down to an individual GP set-up in an OU. Remember the Hierarchical Structure of Security, you can Block this for any individual Policy that you set-up.

Say you want to 'Share' a Folder to a certain Group, leaving the 'Everyone Group' in the permissions would in effect give Everyone access, even thought they may have restricted access.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Best phone camera 2017

Stunning new film posters by Hattie Stewart, Joe Cruz & more

iPad Pro 10.5in (2017) review

28 astuces pour profiter au mieux de votre iPhone