I want to limit "write" access to a file folder or drive. I will create two groups: one can only Read and the other can both Read and Write.
I will assign users to each group. Some user's group membership will change over 24 hours.
What if the Owner is a member of the Read only group? Can he/she still Write? I wouldn't want that.
21 Answer
What if the Owner is a member of the Read only group? Can he/she still Write?
Yes. The owner CAN always change any of the file permissions, after all he is the owner of the file. The TechNet article How Permissions Work provides valuable information on this topic, but most relevant is this:
Permissions enable the owner of each secured object, such as a file, Active Directory object, or registry key, to control who can perform an operation or a set of operations on the object or object property. Because access to an object is at the owner’s discretion, the type of access control that is used in Windows Server 2003 is called discretionary access control. An owner of an object always has the ability to read and change permissions on the object.
