Integrating Local File System Security Into Windows Domain Environments - Compaq N2400 - TaskSmart - 1 GB RAM Administration Manual

Integrating Local File System Security into
Windows Domain Environments
All file ACLs include properties specific to users and groups from a particular
workgroup server or domain environment. In a multidomain environment, user
and group permissions from several domains can apply to files stored on the
same appliance. Users and groups local to the TaskSmart N2400 appliance can
be given access permissions to files and folders on the appliance. The domain
name of the TaskSmart N2400 appliance supplies the context in which the user
or group is understood. File level permission configuration depends on the
network and domain infrastructure where the appliance resides.
Because the CIFS network file-sharing protocol supplies a user and group
context for all connections over the network, appropriate default ACLs are
applied to the file system when new files are created. CIFS configuration tools
provide the ability to share permissions out to clients. These shared
permissions are then propagated into a file system ACL; and when new files
are created over the network, the user creating the file becomes the file owner.
In cases where a specific subdirectory of a share has different permissions
from the share itself, the NTFS permissions on the subdirectory apply instead.
This method results in a hierarchical security model where the CIFS network
protocol permissions and the file permissions work together to provide
appropriate security for CIFS shares on the appliance.
Note the following considerations when CIFS permissions and NTFS file
system permissions are stored in the associated ACL of a file:
CIFS permissions and NTFS file system permissions are implemented
separately. It is possible for files on a file system to have different
permissions from those applied to a CIFS share. When this situation
occurs, the file system permissions override the share permissions. This
feature is useful when a single CIFS share is shared out to a large
community of users but contains several folders, each with access to a
subset of the larger user community.
The CIFS and NTFS security models are designed to integrate
seamlessly. This integration provides the ability for one security model
to be applied to the other security model.
Windows File System Administration 3-69