问题：
You are the administrator of your company’s network. A user named Paul in the service department has a Windows 2000 Professional computer.
Paul needs to access the files that are in a shared folder on his computer. A local group named Sales has permissions to access the data. Paul is a member of the Sales local group but he cannot access the file he needs.
What should you do？ （）
A . Grant Paul NTFS permission so that he can access any parent folder to files in the shared folder.
B . Share the Sales folder and grant Paul shared folder permission to access the shared Sales folder.
C . Remove Paul from any other group that has been explicitly denied access to the Sales folder.
D . Delete the Sales local group and recreate it. Add individual user accounts from the Sales Department back into Sales local group.
You are the administrator of your company’s network. A user named Paul in the service department has a Windows 2000 Professional computer.
Paul needs to access the files that are in a shared folder on his computer. A local group named Sales has permissions to access the data. Paul is a member of the Sales local group but he cannot access the file he needs.
What should you do？ （）
● 参考解析
The Sales group， which Paul is a member of， has permission to access the files. However， Paul still cannot access the files. It would seem that Paul has a permissions conflict. A user can be granted file permissions in a number of contexts： as a user or as a member of a user group. When a user has different file permissions in a multiple contexts， the most restrictive permission is applied. Furthermore， the deny permission overrides all other permissions. As Paul does not have access to the file you must therefore assume Paul has explicitly been denied access to the file in some context， as member of one or more groups that have been denied access to the file. You would thus have to remove Paul from such a group so that the restriction is not applied to Paul.
