Hiding parent folders, give NTFS subfolders full access

Question

On a Windows 2003 server, I need to provide access to a subfolder of the central "project share". The main project folders should not be accessible, preferably hidden, because this access is granted for a freelancer.

Which minimal permissions can be applied to make this possible?

Answer 1

You may want to have a look at the Access Based Enumeration component of Windows 2k3 server ( http://www.microsoft.com/windowsserver2003/techinfo/overview/abe.mspx ), which will hide the folders you don't have access to.

Answer 2

I have a similar problem, where we want a limited number of users to have full access to a sub-folder to the parent, but we don't want them to have any access to the parent folder, other than to see it and traverse it to the sub-folder.

eg.

PROJ
PROJ/Data
PROJ/Docs

We have a group with full access to PROJ
But we want another group to have only Full Access to PROJ/Docs and not to anything in PROJ/Data nor inside of PROJ itself.

I believe we have Access Based Enumeration installed on our W2003 server, and thus the limited group can't see the PROJ directory to traverse it!

The only way I can think of tackling this is to remove inheritance from the tree altogether and assign specific permissions at each sub-folder level. Giving the limited group read only rights on PROJ. But this doesn't get around the fact that they'll be able to see anything in PROJ!

If anyone has any other suggestions as to how to configure the NTFS Permissions for this scenario, I would love to hear them, and hopefully they will help the Original Poster who is in a similar position.

Answer 3

After some experimentation, heres what I found

If I set the Limited group the following access at the parent folder PROJ

Traverse Folder/ Execute File
List Folder / Read Data
Read Attributes
Read Extended Attributes
Read Permissions

And make sure the scope only applies to the Folder Only

Then the users can see PROJ, can't see any files in it, nor the sub-folder Data, but can see the sub-folder Docs. And with Full Access set on Docs means they can see, read and edit files in that sub-folder.

However, if the nesting was deeper

PROJ\WORK\FILES\Docs

I'd have to set the above permissions to each subsequent sub-folder, scoped to Folder Only, prior to Docs to be able to gain access to the Docs folder and files.

I'm sure there has to be a better way to confer this.