How can I restrict a group to reading only two particular folders with Windows Server?

Question

I have a group of users on Windows Server 2003 who need to be able to read the contents of two directories but not be able to access anything else on the server (including read-only access). One of the directories is K:\projectFour\config — and the other is similarly formatted — so it would be okay for group members to be able to list the contents of K:\ and K:\projectFour\ but not actually read anything in those directories.

I've found several resources via SF/Google, including how to restrict individual folders/drives and how to allow users to only run specific executables, but that information ultimately didn't solve my issue. Sorry if this is a really simple thing to do, I'm usually a developer and don't know the first thing about servers or group policies. Finally, I should mention that this isn't a fully concrete question, as it will be implemented eventually but I don't personally have a copy of Windows Server 2003 to test with right now.

Answer 1

NTFS is a bit odd (to some people) in that the same access bit does different things when set on directories than they do when set on files. If you have a structure like this on Server 2003:

\\devsrv\projshare\projectFour\Config

To allow users to view the contents of the "config" directory, but not able to view the contents (just the metadata) of the "\" and "projectFour" directories, several things need to be done. I'm assuming that the users have no other rights that would grant them visiblity/access to the top of that share.

• The top-level directory of the share needs at minimum "RX" privs to that directory only. This can be set under 'Advanced' settings of the permissions dialog box.
  • Put a checkmark in the following rights, "List Folder/Read Data", "Read Attributes", "Read Extended Attributes", "Read Permissions"
  • Ensure that Apply Onto reads, "This folder only"
  • This rights set allows the users to map the share without an Access Denied error.
• Repeat this step on the "projectFour" directory.
• On the 'config' directory, grant the users the simple 'Read' right.

This rights setup, complicated though it is, will allow users the ability to get to the Config directory with a local drive-mapping to the share root. They will be able to enter the projectFour directory and view its directory listing information but no other data.

If you have it available, icacls makes this easier:

(on server)
icacls k:\ /grant [usergroup]:(r)

(on client, if on server replace "\\devsrv\projshare" with "k:")
icacls \\devsrv\projshare\projectFour /grant [usergroup]:(r)
icacls \\devsrv\projshare\projectFour /grant [usergroup]:(oi)(ci)(rx)

(oi) means "object inherit" which means, "apply to files".

(ci) means "container inherit" which means, "apply to directories".

(r) means "Read", when set directly on directories means, "allow users to read meta-data of this directory".

(rx) means "Read & Execute". As (r), but allow users to execute programs in this structure.

When used in conjunction with Access Based Enumeration (available, IIRC, on Server 2003 R2 and higher) users will only see directories and files they have access to. In the above case, users would only see "projectFour" under the root of the share, even if there were thirty other directories at the root.

Answer 2

If I understand what you are looking to do, your best bet would be to create a group for the users that you want to restrict and grant that group only the "List Folder Contents" to the folders that they should be able to see the files but not read them.

You will then also need to remove the restricted users from any groups that might grant them regular access to that folder. One thing to watch out for, I tend to find on a lot of file servers the 'Domain Users' group is given access to folders that everyone should have access to only to later come across a situation like yours.