Re: Folder and Sub-folder permissions

Two observations off the top.

First, I would recommend that you do not use Deny.
Save that as a last (very, very last) resort.

Second, you will not be able to effect the precise specification
you have outlined, mostly because after an account has created
something new in subfolder1 they will be able to obtain more
than specified on what they created.

You will not get what you are after by only making NTFS grants
on e:\dept1

Let us say you have two groups, Dept1Mgrs and Dept1Users

On e:\Dept1 grant
Modify to Dept1Mgrs for This folder, subfolders and files
Read, or perhaps Read/Execute to Dept1Users also set for
This folder, subfolders and files

e:\Dept1 should be set to not inherit, but e:\Dept1\subfolder1
and e:\Dept1\subfolder2 should inherit (from e:\Dept1)

On each of e:\Dept1\subfolder1 and e:\Dept1\subfolder2
add a Modify grant to Dept1Users for Subfolders and files

Now, one last thing is needed to enable Dept1Users to
make new things, so again on e:\Dept1\subfolder1 and
e:\Dept1\subfolder2 grant to Dept1Users
This takes the form of two special grant
1) Create Folders/Append Data for This folder and subfolders
2) Create Files/Write Data also for This folder and subfolders

<markfcook@xxxxxxxxx> wrote in message
news:1189026067.012611.248560@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
i've been asked to cleanup one of our departmental drives...

I have a folder with the following structure
E:\Dept1
E:\Dept1\subfolder1
E:\Dept1\subfolder2

The owner has requested that i grant access to his department so that
only he can create or modify folders in E:\Dept1. However, in the sub-
folders (subfolder1, subfolder2), he wants his department to have all
rights short of ownership and access control. My question is, how do
i do this?

I've tried read-only permissions for "This Folder Only" on E:\Dept1
and granting essentially what is Modify via the "Subfolders and files"
on the folder. at least that's what i think i'm doing with the
following:

currently the settings are
Folder : E:\Dept1
Scope : This Folder Only

Allow the following:
Traverse Folder/Execute File
List folder/Read data
Read Attributes
Read extended attributes
Read permissions

Deny the following:
Create files/Write data
Create folders/Append Data
Write attributes
Write extended attributes
Delete Subfolders and Files
Delete

Folder : E:\Dept1
Scope : Subfolders and files
Allow the following:
Traverse Folder/Execute File
List folder/Read data
Read Attributes
Read extended attributes
Create files/Write data
Create folders/Append Data
Write attributes
Write extended attributes
Delete Subfolders and Files
Delete
Read permissions

the resulting permissions then deny the user from creating new
subfolders, but because of the settings for "Subfolders and Files"
they can still delete things like E:\Dept1\Subfolder1 for example...

maybe i'm missing something obvious, but i cant figure out how to
accomplish the requirements short of setting permissions on each
individual subfolder, which i'm loathe to do....

any help is appreciated...
mark



.

Relevant Pages

  • Re: File/directory permissions
    ... >> projects will have the right permissions by default. ... the requirement that the users not be able to create new subfolders or files ... directly under a project's folder. ... grant List folder contents, and Read to the group of the project. ...
    (microsoft.public.win2000.security)
  • Re: file permissions
    ... The original tools have a rudimentary Deny, ... I grant everything that I can to This folder, subfolders and file on the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: How to set up a folder so that only the creator of a file can modify it?
    ... subfolders, and Files, This folder and files, Subfolders and Files only) ... Grant List to the group, access the Advanced view and highlight ... Modify but granting other than Full to Creator Owner is really just ...
    (microsoft.public.win2000.security)
  • RE: Disappearing Network Share Subfolders
    ... Thank you for posting to the SBS Newsgroup. ... I understand that some of your Windows XP SP2 clients cannot view the ... subfolders in share folders on SBS 2K Server. ... Does the problematic share folder locate at NTFS or FAT32 disk? ...
    (microsoft.public.windows.server.sbs)
  • Re: Read path from text file to process directory structure
    ... Public Function fGetFolder(sFolderName As String) ... Dim FoldersArray As Variant ... 'Read all subfolders of the specified folder into an array ... 'The following string will contain the path of the folder which is currently ...
    (microsoft.public.word.vba.general)