nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Windows 2003 Y: drive madness

Bill Klish

TeamSite 6.5 SP1
Windows 2003 EE

I am trying to do something I thought should be simple and that I know works on solaris. I am setting up a new TS server and want to create some top level branches under default/main that I want to be hidden from users not in the groups. I logged in as master and went to the Administration tab and selected must have read access to list branch contents and must have read access to list workarea contents.

I created the new branch as Administrator, logged out and logged in as a user that was not a member of the Administrators group or the TS group I created for sharing. I am able to see and navigate into that new branch.

I went into windows explorer on the server and noticed that the group everyone is being shared all the way down, which is allowing that user to see the branch. I removed that group at the default/main level, but got a message saying that I couldn't change the permissions on default. Even so, it removed it from everywhere else and things looked like they were working. I rebooted the server and the Everyone group came back and that user can see everything again.

What am I doing wrong?

Find more posts tagged with

Comments

Bill Klish

Should have looked out there first, but just saw that a support article (#55229) was posted, but all it says is this:

Everyone group is required at Y:\ and Y:\default so that users can browse to the main branch from the file system interface. However, on the workarea (name of the workarea), the Everyone group is not present.

Though Everyone has full permission on Y:, Y:\default, and the WORKAREA, STAGING, and EDITION folders, these are non writable folders by design. TeamSite server will not allow any user to perform a write operation on them. So, the Everyone permission on these folders cannot hamper the security. This group is required so that the users can view or browse through the IFS volume (Y: drive).

Currently, it is not possible to remove Everyone group from Y: and Y:\default Access Control List. It is also not possible to substitute Everyone group with another group.

I removed this at levels beneath /default/main and am no longer able to see branches which I should. I see nothing under /default/main now.

Does anyone have this working correctly?

Bill Klish

I am going backwards here.....

So, if I remove Everyone at lower levels, I no longer see the correct TS group listed in the properties, but instead see TEAMSITE65\iwgroup, which I know is what TeamSite is using to make the TS groups work. If I put everyone back, the group appears correctly in the UI.

Bill Klish

Ok, finally think I am getting somewhere here.

The exact steps I took seemed to work and it works after reboot.

Create the new top level branch. Go into windows explorer and remove Everyone from the security tab, by not inheriting it from the parent. Then, go back into the TS UI as an Administrator role user with permissions on your new top level branch and re-apply your TS Group Name.

I rebooted and everything stayed correct. Seems like a P.I.T.A. to get it setup correctly. Is there an easier way?

Adam Stoller

Ok, finally think I am getting somewhere here.

The exact steps I took seemed to work and it works after reboot.

Create the new top level branch. Go into windows explorer and remove Everyone from the security tab, by not inheriting it from the parent. Then, go back into the TS UI as an Administrator role user with permissions on your new top level branch and re-apply your TS Group Name.

I rebooted and everything stayed correct. Seems like a P.I.T.A. to get it setup correctly. Is there an easier way?

When you (or whomever) initially installed TeamSite - did they define a webserver_group (e.g. TeamSite Web Preview) in the iw.cfg *and* ensure that such a group existed on the system prior to the installation?

If you do that - then Everyone should only appear in the locations indicated by the KB article (I'm glad someone already got use out of it - I was in part responsible for getting it written on behalf of one of my customer's).

If you do not have that pre-setup done - I believe you have to go through the laborious efforts of explicitly removing Everyone from the various workareas and folders after-the-fact (there might be an easier way after-the-fact but I'm not sure)

cgoodall

Is one able to edit the perms on the STAGING, EDITION and WORKAREA folders via the Y: (IFS) drive?

We need to add an additional access group. We can add the group to the branch folder, but not the sub-folders. When trying to make any change, we get a permission denied error even though we have 'full contol'.

We're running TeamSite 6.7 on Windows 2003.

Thanks,
~Chris

Adam Stoller

Is one able to edit the perms on the STAGING, EDITION and WORKAREA folders via the Y: (IFS) drive?

We need to add an additional access group. We can add the group to the branch folder, but not the sub-folders. When trying to make any change, we get a permission denied error even though we have 'full contol'.

We're running TeamSite 6.7 on Windows 2003.

Thanks,
~Chris

You can only modify permissions on, and within, the sub-folders of the WORKAREA folder. The IFS prevents any changes being made to the STAGING, EDITION, WORKAREA folders and any files or directories within the first two.

cgoodall

Ahhh...That was my suspicion. Thanks for the reply. Is there any other method for changing branch permissions besides iwaccess (which is broken)?

Interwoven Support is also looking into this issue. They have confirmed that iwaccess doesn't work with the 'add-windows-permission' option.

Thanks again,
~Chris

cgoodall

For everyone's benefit, here's the word from the Interwoven engineers regarding using the iwaccess CLT to change Windows branch permissions:

"the 'add-windows-permission' directive is applicable for only files and folders(in a workarea). You would use this to add 'aces' to the files and folders. At the branch level the only meaningful thing to do is to assign roles to users."