1

I'm having trouble coming up with a solution to this one, maybe because I don't know enough about how Windows ACLs work.

I have two folders, let's call them Directory A and Directory B. These are contained within another directory.

The users that are supposed to see Folder B are in an AD group; Group B. It's not practical to put everyone else in a different group - this is for just a few out of 1000 users.

I just want the users who are in the group to see Folder B, and Everybody Else to just see Folder A.

How should I set up my permissions?

(In case this is relevant, these folders are for Start Menu shortcuts for users whose Start Menu is redirected to a network location via GP.)

6 Answers 6

5

It sounds like you need Access-based enumeration, which is a fancy way of saying "if you don't have access to it, you can't see it".

See here.

2
  • I'd be hesitant to use this as it looks like it was last updated in 2005, and isn't widely supported.
    – Adam Brand
    Jul 2, 2009 at 19:10
  • It's a pretty simple feature, how much updating could it really need? It's still around in Server 2008 FWIW. I assume you meant "widely used" rather than "widely supported", since its not really something thats so complex it requires special application support. Jul 2, 2009 at 19:29
2

So far as I'm aware, you can't use permissions to determine which folder a group can see. You can use Deny to keep a group from accessing the folder, but it'll still be visible.

6
  • So maybe I'm approaching the problem from the wrong direction. Maybe I should put the workstations that need Folder B in a separate OU and redirect their Start Menu to a different location.
    – Doug Chase
    Jul 2, 2009 at 17:36
  • You beat me to it... Also, since he's using these folders as part of the Start Menu, users might get an Access Denied error when they click the Start button. Jul 2, 2009 at 17:36
  • Took the words out of my...er, fingers, Doug. Jul 2, 2009 at 17:40
  • I was trying to avoid that but it is what I shall do! Thanks for stopping by :)
    – Doug Chase
    Jul 2, 2009 at 17:47
  • 2
    You can restrict what's visible based on permissions, see my answer below. Jul 2, 2009 at 18:54
1

In the advanced security settings for folder B turn off inheritance. Create a group for the folder B users. Assign this group rights to the folder.

1

So you would give read access to AD group B and remove all other groups. Then you would allow all read for folder A.

Do you need group B not to see folder A?

2
  • Yeah, I just want group B to see folder B, and not folder A, but I want group A to see folder A and not folder B.
    – Doug Chase
    Jul 2, 2009 at 17:34
  • So you would need two groups. Deny takes precedence over read so you can't just deny all and allow some.
    – MathewC
    Jul 2, 2009 at 17:37
1

Maybe, only grand Group B for folder B, and deny Group B for Folder A. All groups should be assigned on the parent folder.

Hope it helps.

1

What you want is the Access Based Enumeration feature in Server 2008 or 2008 R2, it will allow you to hide a folder from a user as you have requested.

See MVP Blog post for more info.

Also, you can install the ABE add-on for Server 2003 if you're not running Server 2008.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .