Microsoft KB Archive/149344

= Microsoft Knowledge Base =

NWCONV.EXE Does Not Correctly Apply Permissions
Last reviewed: March 11, 1997

Article ID: Q149344

3.50 3.51 WINDOWS kbbug 3.51

The information in this article applies to:


 * Microsoft Windows NT Server versions 3.5 and 3.51

SYMPTOMS
When you use NWCONV.EXE to convert files and directories from a NetWare server to a Windows NT Server, you may encounter permissions problems. NWCONV.EXE does not correctly propagate nested permissions in the following example

server\volume\SHARE\TEST\A..F where normal default permissions reside on volume:

SHARE has a GROUP trustee w/ (R F)  TEST  has a GROUP trustee w/ (RWCEMF) A    has a GROUP trustee w/ (R F)   B..F  through inheritance on TEST would also be (RWCEMF) After conversion, Windows NT shows the following rights:

SHARE has GROUP w/ RX RX  TEST  has GROUP w/ RWXC RX   A     has GROUP w/ RX RX   B..F  has GROUP w/ RX RX Note that b..f has RX RX, not RWXD RXWD, as you would expect. This problem does not occur if you remove the trustee on SHARE.

CAUSE
When NWCONV.EXE is doing the conversion from a NetWare server to an NT Server, it checks the access control list (ACL) and looks for all access control entries (ACEs) associated with the file or subdirectory. There is a problem in NWCONV.EXE where multiple ACEs for groups in the same directory structure are not correctly assigned to the NT ACL because the NWCONV.EXE code does not walk through the entire ACL, so if there are multiple ACEs for a group, the second ACE does not get converted to the Windows NT ACL.

RESOLUTION
To correct this problem, apply the fix mentioned above.

STATUS
Microsoft has confirmed this to be a problem in Windows NT versions 3.5 and 3.51. A supported fix is now available, but has not been fully regression- tested and should be applied only to systems experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft recommends that you wait for the next Service Pack that contains this fix. Contact Microsoft Product Support Services for more information.