1

I need to prevent the acl subtitution during folder copy and I don't know how to do. I have two repositories, the source and the destination with different acl. Users have to copy (with windows's file explorer) some folders from source to destination but I want that the copied folder inherit the destination acl. Now I see that the acl are copied and maintained from source to destination.

How to let windows explorer copies folder form source to destination using destination acl inheritance instead of original acl? Mind that source and destination are on the same network volume.

Thanks

Edit

I found that if I copy folders using network paths (ex. \\server\share\folder) everything works as I need (the folder inherit the destination acl), the problem is just if I use mapped network volume (ex. z:\share\folder).

Tobia
  • 1,210
  • 8
  • 37
  • 73
  • Can you re-state this in the form of a **question**. – Zoredache Mar 06 '13 at 08:46
  • 2
    is it possible that your users are *moving* the folders instead of copying them? Note that moving would trigger a completely different operation than copying when operating within the same filesystem (or on the same network drive) leading to the behavior you are describing. – the-wabbit Mar 06 '13 at 10:02
  • Of course it is possibile... I supposed that moving is something like copying + deleting. – Tobia Mar 06 '13 at 12:08

1 Answers1

4

The behavior you describe as the desired one is in fact the default with all versions of Windows. Copied files and directories are re-created at the destination inheriting the permissions of the destination folder.

There are mainly two conditions where this might not be the case:

  1. your users are not copying but moving the files and directories within the same file system. In this case, filesystem ACLs are not changed as a "move" operation is simply re-writing the pointers to the destination in the file system and does not do anything to ACLs (which are stored in a different attribute). This behavior can be changed by setting the MoveSecurityAttributes (DWORD) value in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer key to 0 on all your client machines. Note that for MoveSecurityAttributes to work on newer versions of Windows (on from Vista / Server 2008) you need to install a hotfix as described in MS KB 2617058: "MoveSecurityAttributes" registry subkey does not work in Windows 7, in Windows Vista, in Windows Server 2008 or in Windows Server 2008 R2.

  2. you have changed your Windows users' Explorer default behavior to copy permissions with the file by setting ForceCopyAclwithFile in the HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer key to 1.

Suggested reading: MSKB 310316: How permissions are handled when you copy and move files and folders

the-wabbit
  • 40,319
  • 13
  • 105
  • 169