Author: NetworkAdminKB.com
Created: 2008-10-13
Modified: 2008-11-19

Information:

To fully understand the “Creator Owner” object that you see listed in NTFS permissions list, you must first understand the concept of an Owner.

 

In Windows every object has an owner, whether on an NTFS volume or in Active Directory. By design, the owner of the object can only configure how permissions are set, and to whom permissions are granted.  By default the owner is usually automatically granted read, write, or modify permissions through some other group, but this does not need to be the case.

 

By design, in Windows Server 2003 the owner is the creator of the object.  If the creator of an object is a member of the Administrators group, the Administrators group is the owner. The owner can always change permissions on an object, even when denied all access to the object.

 

The “Owner” of the object is not the same thing as the “Creator Owner” built-in group available when applying security in NTFS and Active Directory.  However, the “Creator Owner” group does allow administrators to assign specific permissions to the Owner so that they may read, write, or modify an object they would otherwise not have access to.  The need for this type of configuration is very limited in scope.  This is because of the way NTFS and Active Directory systems are structured.  In a normal environment users that create objects, automatically have access to them granted through some other group or user permission.  Since, by default, all objects inherit permissions from their container, the permission that allowed the user to create the object normally allows them to read, write, or modify the object they just created.

 

How “Creator Owner” works

The “Creator Owner” group is unique because when applied to a folder the following permission changes happen.

1)      The Owner (creator) of the object is “semi-statically” assigned the same permissions as the original “Creator Owner” group.  These permissions are “semi-static” because if you remove the “Creator Owner” group the permissions for the user are removed as well.

2)      If the owner of an object changes, the permissions on the object do not change to the new owner.

3)      If the object created is a Folder, the “Creator Owner” group is re-applied to the newly created folder, along with the permission listed in Item 1.

 

Not all the same configuration options are available to the “Creator Owner” group as with normal permissions.  For example; the NTFS standard options of Modify, Read & Execute, etc. are not maintained, even if selected.  Also, not all the “Apply onto:” options in the advance tab work as expected.

 

Summary:

Because of the way NTFS works you can normally safely remove the “Creator Owner” object from the root of all NTFS volumes and all folder structures that use it.  This object is little more than a wasted ACL to evaluate on every object.  However, as specified earlier there are special case configurations in which “Creator Owner” object is useful.  The special case is very uncommon to encounter, but it is possible to configure a folder where users can create documents (of which they are the owner) but to which they are not assigned permissions from any other group.  In this case you would use the “Creator Owner” group to assign permissions (read, write, modify, etc) to the user that created the objects.  This type of configuration is typically called a “drop folder”.

 

Finally, there are no system processes that depend on the “Creator Owner” group having access to an object in NTFS or Active Directory.

 

More Information:

Permissions on a file server

http://technet.microsoft.com/en-us/library/cc780823.aspx

Article ID: 80, Created On: 9/17/2011, Modified: 9/17/2011