4 Replies Latest reply on Sep 23, 2009 5:38 AM by 1-7JYGPT

    Users Inheriting Group Settings

    Jeremy Schmidt

      Why is it that if a user is a member of two groups with opposite permissions, that user doesn't inherit the permissions?  The properties screen shows that the user is inheriting the permission and the workflow state shows the permit box as filled in (not checked and not empty), but this doesn't seem to be the case.

       

      Example:

       

      Everyone Group has state permissions to make a state change

      Engineering Group has nothing enabled/disabled for the state change

      The User has nothing enabled/disabled for the state change

       

      if User A is a member of only the Everyone Group, he/she CAN make the state change

      if User A is a member of both the Everyone Group and Engineering Group, he/she CANNOT make the state change

       

      Correct me if I'm wrong anywhere here, but I think Windows is the opposite.  Don't you always inherit permissions unless it is specifically a deny permission?

       

      Please tell me that I'm just missing something simple here.  I'd rather not have to apply settings to every group rather than to one Everyone group.

        • Re: Users Inheriting Group Settings
          Jeremy Schmidt

          To add to this.  The warnings, which are deny permissions, do inherit down as I would suspect.

           

          Ex:

           

          Everyone Group has "File is in wrong state." warning enabled.

          Engineering Group does not

           

          User A is a member of both the Everyone Group and the Engineering Group and is not able to change the state if the file is in the wrong state.

            • Re: Users Inheriting Group Settings
              Usually the most restrictive settings is that are applied. In windows is the same thing. I have also same situation and I change permission for the specific user.
                • Re: Users Inheriting Group Settings
                  Jeremy Schmidt

                  If this is supposed to be the case, then why does the group icon appear to the right of the permission in the user specific settings, indicating the the permission is inherited, only when the permission is ENABLED in the parent group?

                   

                  And if Windows applies the most restrictive settings, how come the following is true...?

                   

                  The directory "Test Directory" has the following domain groups in the directory security

                  "Domain Users" (this is everyone on the domain) has read and list permissions

                  "Engineering" has modify permissions

                  User A is a member of both domain groups and is able to modify the files in the directory

                   

                  It's not that I don't believe you, I'm just having a hard time understanding why it is behaving the way it is.  Thanks for your help.

                    • Re: Users Inheriting Group Settings

                      My questions about "Test Directory" are:

                      is a shared folder - if is true there are also share permission;

                      permissions are inherited or not - if are inherited and parent object has other permission all is changed.

                      user A is a member only to the two groups or is member also to other groups

                      and the last one the user A is by the way the owner of the folder?