Re: How to restrict access to just Files, not Folders

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 01/31/05


Date: Sun, 30 Jan 2005 18:24:06 -0600

It looks like you pretty much did what I suggested with two different groups
though I believe I misunderstood your original post thinking that you wanted
to let users create/modify folders but not files for whatever reason. You
will find that you have great flexibility with advanced permissions and I
usually try to accomplish a configuration without using deny permissions
which tend to complicate things, particularly since an explicit allow
overrides an inherited deny. --- Steve

"Tom Gibson" <Tom Gibson@discussions.microsoft.com> wrote in message
news:97E9C963-07EF-4771-91AC-2F56A38AE3DB@microsoft.com...
> to all: thanks for the quick responses.
> I had selected the constraint of Files only, but then my users were not
> permitted to traverse any subfolders.
>
> I had missed the fact that users could be listed in the Advanced page more
> than once. I shall have to try that.
>
> My solution:
> Authenticated Users: Traverse Folder / List access - This folder,
> subfolders
> and files
> Folder Admins: Modify - This folder, subfolders and files
> Folder Users: Modify - Files only
>
> Then I reset it for all objects below.
> Now, when for each folder, the files have the permissions required. A
> user
> can add, delete, modify any files. But to traverse the folders, they are
> using the Authenticated Users permissions.
>
> Thanks
>
> "Steven L Umbach" wrote:
>
>> This should work. On the main security page give the group
>> read/list/execute
>> to the folder. Then go into "advanced" permissions and add the group
>> again.
>> Then select "folder and subfolder" in the apply onto box and check all
>> the
>> permissions other than full control and change permissions. What many
>> seem
>> to miss is that a user or group can be listed multiple times in advanced
>> permissions. --- Steve
>>
>>
>> "Tom Gibson" <Tom Gibson@discussions.microsoft.com> wrote in message
>> news:EF4D0033-221C-4201-A893-90C536D34349@microsoft.com...
>> >I want to restrict access to users to be able to create, delete, modify
>> > files, but not folders.
>> > The security options are not granular enough that I can tell.
>> > If I unselect Delete Subfolders and Files AND Delete, then folders
>> > cannot
>> > be
>> > deleted, but either can files.
>> > If I unselect just Delete Subfolders and Files, and leave Delete, then
>> > both
>> > can be deleted. Same is true if just Delete Subfolders and Files is
>> > selected.
>> >
>> > Any recommendations is requested and appreciated.
>> >
>> > Thank you.
>> >
>> > Tom Gibson
>>
>>
>>



Relevant Pages

  • Re: How to make a mailbox read only for others
    ... dragging emails in and out of the mailbox making a mess. ... set the permissions in that user's mailbox in Outlook, on the folders they ... I don't think subfolders inherit the permissions you set on ...
    (microsoft.public.exchange.setup)
  • Re: Ooops not resolved
    ... I just discovered that I can open a document if I give the Administrator ... Different subfolders have different property settings. ... Some permissions are editible and some aren't. ... I have deleted files and folders that others have created. ...
    (microsoft.public.windows.server.networking)
  • Re: NTFS Security Question.
    ... A subordinate object DOES not inherit the PARENT perms (in ... will assume "Nebulous" permissions that refer to the LINK ... The trick is to PROPOGATE to all FILES (not Folders and Files - that would ... Since Windows 2000 deny NTFS permission does not work ...
    (microsoft.public.windowsxp.security_admin)
  • RE: ISA 2004 REPORT FAILURE
    ... Did as you suggested and turned auditing on for the system and folders ... that is setting the wrong permissions of the folders ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • RE: ISA 2004 REPORT FAILURE
    ... the ISA Reports still fail because ... I can change the permissions manually ... on the ISALogs and ISASummaries folders ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)