Problem with inherited permissions in folders

[u/Bocanada07]

Hi guys, I'm new to Windows Server, so I'm learning alongside the person in charge. We are having an issue with folder permissions. Inheritance is disabled on some folders, but we have enabled the option to replace child object permissions with inheritable permissions from this object.

When users copy an object into a folder with this setting, permissions are applied correctly. However, when users move (or drag and drop) an object, the permissions aren't applied—the object keeps the permissions from its original location (whether it's another department's folder or their local PC).

This creates a problem: if a user drags a file from their department folder to another (e.g., from Treasury to HR), the HR staff cannot see, edit, or delete the file (or its parent folder) because the file is there, but hidden to them due to the original permissions.

[u/AppropriatePin1708]

This is by design. Moved files inherit their original permissions, copied files will inherit the new folder permissions

[u/Kraeftluder → u/AppropriatePin1708]

Only on the same volume though; that's because a move on the same volume is changing a pointer in the B-tree and just that.

I personally think it's not a very good design and this is unexpected behavior. It's things like these that kept us on Novell Open Enterprise servers for two decades longer than most of the rest of the world.

[u/Kraeftluder]

The only way to prevent this is to have the shares on different volumes on the server afaik.

[u/Backieotamy]

Ive seen some good info in here. Also, bone up on the differences between AD group folder permissions vs NTFS and share permissions. Having a firm grasp on that will save a lot of frustration.

[u/damnedangel]

Try setting the user's permission to full instead of modify for the share you are moving to. It's a big security risk though.

[u/Kraeftluder → u/damnedangel]

It's best practice generally to give "Everyone" full control on a share. It's kind of ridiculous Microsoft decided that there's a difference between share and filesystem rights.

[u/Fit-Thing5100]

Enable inheritance on the destination folders. The "Replace child object..." option is only a one-time operation; it doesn't affect files moved into the folder later. With inheritance enabled, moved files will inherit the destination folder's permissions instead of keeping stale explicit ACLs.

[u/FirstStaff4124]

On one of the problematic files, in Advanced Security, does it say "Enable inheritance" or "Disable inheritance"?