1. First I create new user TEST. (By default he is a member of USERS group)
2. Next I create folder ABC and set permissions as follows:
- ADMINISTRATORS - ALLOW - FULL CONTROL
- USERS - DENY - FULL CONTROL
3. Next I remove users TEST form the group USERS.
4. Next I log in as TEST and try to access folder ABC - which is ACCESS
DENIED.
5. Now user TEST is only a member of Administrators group (FULL CONTROL
ALLOW).
The question is: why TEST has no access to folder ABC ?

lanwench [mvp - exchange]

In news:84635A83-B75C-4C6B-B211-E23E20C9D22B@microsoft.com,
domin <domin@discussions.microsoft.com> typed:


These are all local users/groups, right? Not domain users / groups?

I'm not 100% sure about this, but if you mean the built-in "users" group, I
don't think you can actually remove anyone from it. And a 'deny' always
trumps an 'allow' from another group.

I would set up custom groups for your security. You likely don't need
"deny" on anything, anyway - just don't add that group to the 'allowed' list
at all.

Someone may correct me; it's happened before. :-)