The VFS access system is regulated by three rules. The rules differ from the rules that govern Windows NT permissions.
User permissions are given priority.
This means that if the server finds user specific permissions (not those from groups) in the folder that the user wants to access, then the server does not look for any group permissions. The server will give priority to these individually configured permissions. For example, suppose that you have an individual user with the user name Bob. Bob is a member of two permission groups that have download and list permissions only for Folder1. However, you have decided that you want to give Bob full permissions for Folder1 without creating a new permission group, so you add Bob to the file and give him full permissions. Since the server looks for these individual user permissions first, then Bob will have full permissions for Folder1 no matter how his group membership is configured. This same rule also implies that if Bob has individual permissions that only allow him to download files from that particular folder, it does not matter if he is a member of two groups that have full permissions for the folder. Bob will only have permission to download files.
If a user does not have individual permissions for a folder and is a member of more than one group, the server gives the user the least restrictive access for the folder.
From their groups, users receive all the permissions available for the folder. For example, suppose a user with the user name Jan is a member of two groups, Group1 and Group2, that both have permissions for a particular folder, Folder2. If Group1 has download permission and Group2 has upload permission then Jan will have both upload and download permissions for Folder2.
The All Users group is the same as any other group except that it can't be removed from the root folder permissions list.
You can use the All Users group to determine inherited permissions from the parent folder in the Administrator Interface. If you change any inherited permissions for the All Users group, the server display a screen to make sure you want to change the inherited permissions.