Mac on SBS - Share Permissions Puzzle...

Since starting the publications, I have been working on them on the iMac via the SMB://mysharingserver/Users/MyUsername/My Documents redirect share.

SMB Signing has been disabled via Group Policy as instructed in the draft document for connecting a Mac to an SBS network.

Our My Documents redirect to a server other than our SBS box. This was still accomplished via the Configure My Documents Redirection wizard under Shares in the Server Management Console.

On the folder that contains the contents of the publications we have suffered an irreparable permissions corruption on the specific folders the publications are in. We had to login directly to the file server hosting the My Documents folders and correct the permissions. But, they still kept exploding.

Keep in mind that SBS sets the Special Permissions of "Full Control" on "This Folder Only" on the Users (x:\Users Shared Folders folder, not a user's folder) root share. These permissions carry over to the user's root folder when they first login to the domain and their My Documents get redirected to a file server other than the SBS box. It is important to note that every subfolder receives those Special Permissions!

This may be what is messing things up.

So, after examining SBS installations where the Users folder is resident on the SBS box, it turns out that SBS sets "Full Control" to the user's own root folder share and propagates that across all subfolders and files. When you look at the user's NTFS Security properties, there are a bunch of white squares with check marks in them up to "Full Control" on the their root folder. All subfolders are set to inherit so they pick up the "Full Control" with no issues (grayed out checked boxes).

We will begin the task of resetting those permissions immediately. It will be a big task as we have a lot of data in the redirect folders.

Hopefully the resetting of the folder permissions will fix the issue.

For those working with Macs on networks where the My Documents folder is redirected to a server other than the SBS box, then keep a look out for those permissions and the need to modify them!

While working on this process, we finished the last step of adding the iMac to the SBS domain:


The OS X 10.4.10 Directory Access interface was laid out differently than what is in the document, but I was able to figure it out.

Kinda looks neat having it nested there with the Windows boxes! :D

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.