I just noticed something on a few of my windows servers. I never give full
control permissions to normal users, I just give them modify permissions if
they need read/write access to a folder. So, with modify permissions the
Change Permissions and Take Ownership rights are removed, or so I thought.
I've check on two of my clients (I'm a contractor) servers one was Windows
2003 and the other was Windows 2000 w/ SP4 and any user with modify
permissions can simply right click on the folder or file in question and
click Full Control, hit apply and it works. The folder has only two ACLs
setup one for Domain Admins which is full control and the other is on that
specific user or group. I remove the Full Control permissions to
Creator/Owner that Windows 2003 likes to setup by default on SBS 2003. This
doesn't seem right to me. What am I missing here, the users aren't domain
admins, just normal domain users?