We are using an Iomega file storage which is connected to our network. Our Windows Domain Controller is creating a share to this file storage, so our Windows users can easily access the share using \domaincontroller\share

When those users create a new folder, the file/directory permissions are inherited from the parent's folder. Everybody can read/write in their newly created folders, which is perfect.

When a Mac user (which is directly accessing the file storage) is creating a new folder, special permissions (read/write for current user) are applied and no else can write files in this newly created folder. The only way to solve this, is to RDP to a Windows console and reset the ACL's.

What's the best practice to solve this problem?

  • Our Storage is writing the ACLs automatically for the OS X Clients by simply setting the owner/group to "admin:administrators". The ACLs are controlled via an AD. That works for us and all folders have the right permissions automatically.
    – rwenz3l
    May 13, 2014 at 15:14
  • Can you tell me where in AD you configure this? Seems exactly what we need May 13, 2014 at 15:16
  • Btw, we are using an old Windows 2003 server (SBS) May 13, 2014 at 15:18
  • You said "directly accessing." What does that mean, e.g. connection protocol, storage format, etc.? @YoshiBotX Learning AD at the moment. I'd love to learn how to control ACL's via AD. :)
    – thankyour
    May 14, 2014 at 2:04
  • I mean: Finder > CMD + K > SMB://#NAME_OF_MY_FS May 14, 2014 at 6:57

1 Answer 1


By default, Active Directory objects inherit ACEs from the security descriptor located in their parent container object. Inheritance enables the access control information defined at a container object in Active Directory to apply to the security descriptors of any subordinate objects, including other containers and their objects. This eliminates the need to apply permissions each time a child object is created.

If necessary, you can change the inherited permissions. However, as a best practice, avoid changing the default permissions or inheritance settings on Active Directory objects. For more information, see Best practices for assigning permissions on Active Directory objects and Changing inherited permissions.

  • Yes, I can do that, but then I have to inherit the permissions each time manually, when I create a new folder? I want this process to be automized ... May 14, 2014 at 6:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .