NTFS is a bit odd (to some people) in that the same access bit does different things when set on directories than they do when set on files. If you have a structure like this on Server 2003:
To allow users to view the contents of the "config" directory, but not able to view the contents (just the metadata) of the "\" and "projectFour" directories, several things need to be done. I'm assuming that the users have no other rights that would grant them visiblity/access to the top of that share.
- The top-level directory of the share needs at minimum "RX" privs to that directory only. This can be set under 'Advanced' settings of the permissions dialog box.
- Put a checkmark in the following rights, "List Folder/Read Data", "Read Attributes", "Read Extended Attributes", "Read Permissions"
- Ensure that Apply Onto reads, "This folder only"
- This rights set allows the users to map the share without an Access Denied error.
- Repeat this step on the "projectFour" directory.
- On the 'config' directory, grant the users the simple 'Read' right.
This rights setup, complicated though it is, will allow users the ability to get to the Config directory with a local drive-mapping to the share root. They will be able to enter the projectFour directory and view its directory listing information but no other data.
If you have it available, icacls makes this easier:
icacls k:\ /grant [usergroup]:(r)
(on client, if on server replace "\\devsrv\projshare" with "k:")
icacls \\devsrv\projshare\projectFour /grant [usergroup]:(r)
icacls \\devsrv\projshare\projectFour /grant [usergroup]:(oi)(ci)(rx)
(oi) means "object inherit" which means, "apply to files".
(ci) means "container inherit" which means, "apply to directories".
(r) means "Read", when set directly on directories means, "allow users to read meta-data of this directory".
(rx) means "Read & Execute". As (r), but allow users to execute programs in this structure.
When used in conjunction with Access Based Enumeration (available, IIRC, on Server 2003 R2 and higher) users will only see directories and files they have access to. In the above case, users would only see "projectFour" under the root of the share, even if there were thirty other directories at the root.