effective permissions

I have noticed that the Public folder allows users Modify files created by
other users. XP only allowed to Read. So I have checked Effective Permissions
of a user and shows that users have no Permissions at all. So I suppose that
Users get the permissions from the INTERACTIVE account. So I check
INTERACTIVE permissions and only Read permissions appear. How can Users
Modify files that have not been created by themselves then?

There is an inherit only ACE on %systemdrive%\users\public that grants
INTERACTIVE modify right. This way they can modify content in the folder, but
not delete the folder itself:
C:\Windows\system32>icacls c:\users\public
c:\users\public BUILTIN\AdministratorsOI)(CI)(F)
CREATOR OWNEROI)(CI)(IO)(F)
NT AUTHORITY\SYSTEMOI)(CI)(F)
NT AUTHORITY\INTERACTIVEOI)(CI)(IO)(M,DC)
NT AUTHORITY\INTERACTIVERX,WD,AD)
NT AUTHORITY\SERVICEOI)(CI)(IO)(M,DC)
NT AUTHORITY\SERVICERX,WD,AD)
NT AUTHORITY\BATCHOI)(CI)(IO)(M,DC)
NT AUTHORITY\BATCHRX,WD,AD)

"Francisco" wrote:

> I have noticed that the Public folder allows users Modify files created by
> other users. XP only allowed to Read. So I have checked Effective Permissions
> of a user and shows that users have no Permissions at all. So I suppose that
> Users get the permissions from the INTERACTIVE account. So I check
> INTERACTIVE permissions and only Read permissions appear. How can Users
> Modify files that have not been created by themselves then?

Thanks

"Jesper" wrote:

> There is an inherit only ACE on %systemdrive%\users\public that grants
> INTERACTIVE modify right. This way they can modify content in the folder, but
> not delete the folder itself:
> C:\Windows\system32>icacls c:\users\public
> c:\users\public BUILTIN\AdministratorsOI)(CI)(F)
> CREATOR OWNEROI)(CI)(IO)(F)
> NT AUTHORITY\SYSTEMOI)(CI)(F)
> NT AUTHORITY\INTERACTIVEOI)(CI)(IO)(M,DC)
> NT AUTHORITY\INTERACTIVERX,WD,AD)
> NT AUTHORITY\SERVICEOI)(CI)(IO)(M,DC)
> NT AUTHORITY\SERVICERX,WD,AD)
> NT AUTHORITY\BATCHOI)(CI)(IO)(M,DC)
> NT AUTHORITY\BATCHRX,WD,AD)
>
> "Francisco" wrote:
>
> > I have noticed that the Public folder allows users Modify files created by
> > other users. XP only allowed to Read. So I have checked Effective Permissions
> > of a user and shows that users have no Permissions at all. So I suppose that
> > Users get the permissions from the INTERACTIVE account. So I check
> > INTERACTIVE permissions and only Read permissions appear. How can Users
> > Modify files that have not been created by themselves then?