Hotfix Changes Services for Macintosh Behavior in Windows 2000 (320215)

SYMPTOMS

Permission Translation

The set of permissions that are available for Windows 2000 users differs from the set of permissions that are available for the Macintosh. Services for Macintosh automatically translates permissions so that permissions are enforced for both Windows 2000 and Macintosh users.

The Windows 2000 Server administrator account always has Modify permissions on Services for Macintosh volumes.

Permissions that are set in Macintosh networks behave differently from those that are set in Windows 2000 Server networks, including Macintosh-style permissions. From the Macintosh computer, a right that is assigned to everyone overrides more restrictive rights that are set on the owner or a group. From Windows 2000, permissions that are assigned to everyone do not override permissions that are set on the owner or group.

The built-in Everyone group on a Macintosh client only understands limited permissions. If you want to deny the Everyone group from a Macintosh client share, you must set the permissions on Windows 2000 by not explicitly setting deny but matching the no-access setting that Macintosh uses. To do this, set the Advanced Security properties to allow Read Attributes and Read Permissions for the Everyone group. On the Macintosh side you see a belt around the folder for those users who do not have explicit rights. If you do not do this, the Everyone group receives Read and Execute, List Folders and Read, plus any additional settings that you have checked for the Everyone group.

Rules for Inheritance Before the Hotfix

Inheritance changes occurs if, for example, you use a group membership to grant folder-creation permissions to a Macintosh client and the Macintosh client creates a folder. After this occurs, inheritance is turned on for the subfolder for the group the user receives Full Control.

Example

You create a MACUSER to connect to a Windows 2000 Service Pack 2 Services for Macintosh share from a Macintosh computer. You put the MACUSER membership in a domain group that is called MACGROUP. You have the permissions set like this:

Root Folder

MACGROUP (Modify, Read/Ex, List Folder Contents, Read, Write)

If the MACUSER then creates a subfolder that is named Sub-Folder in Root-Folder, the resulting permissions would include the MACUSER with the addition of Full Control like this:

Subfolder

The inherited flag will be checked
MACGROUP (M, Rx, L, R, W) (An Inherited permission)
MACUSER (FC, M, Rx, L, R, W)
Everyone (Rx, L, R)

This can be adjusted by removing Rx and L, and by explicitly setting the Advanced Security properties to allow Read Attributes and Read Permissions. On the Macintosh side you see a belt around the folder for those users who do not have explicit rights. You do not want to do this at the root share because you will deny the Everyone group, and no one will be able to create anything.

SYSTEM (M, Rx, L, R, W)
The User's Primary Group (M, Rx, L, R, W)
Administrator (FC, M, Rx, L, R, W)

Notes About Everyone and System Groups

The first noticeable difference of an NTFS file system folder that is created by a Macintosh client in a Services for Macintosh share is that the NTFS permissions include the Everyone and SYSTEM groups as:

By default, Windows 2000 gives each new folder Read and Execute, List Folders, and Read for the Everyone group. To prevent this, explicitly set rights under the Advanced security properties to allow Read attributes and Read permissions. On the Macintosh side, you will see a belt around the folder for those users who do not have explicit rights.
By default, the SYSTEM group is given Modify, Read and Execute, List Folders and, Read and Write permissions. The SYSTEM Group is granted permissions because the SFM service is running under the SYSTEM context and SFM is responsible for actually completing the file input/output.

CAUSE

The Windows NT operating system in conjunction with using NTFS gives administrators more control over user and group-level permissions. The Macintosh operating system does not recognize all of the custom file, user, and group permissions for folders and files.

Permission Differences

The permissions that are set for Macintosh folders compared to that of the NTFS permissions set are drastically different in granularity. On the Macintosh side, the only permissions you can set are Read, Write, and None. With NTFS permissions, you can set Read, Write, Execute, Modify List and Full Control. Services for Macintosh must translate these permissions to provide the Macintosh operating system with a list of security permissions that it understands. Another aspect of Windows 2000 Server user accounts, the user's primary group, applies only to Services for Macintosh. The user's primary group is the group that the user works with most, and it is typically the group with which the user has the most resource needs in common. When a user creates a folder on a server, that user becomes its owner. The owner's primary group is set as the group that is associated with the folder. The administrator or owner can change the group that is associated with the folder.