windows server 2008 file permissions

Question

I have the following folder structure:

A
|--B
|  |--C
|  |--D
|
|--E
   |--F
   |--G

Each sub-sub folder (C,D,F,G) has a corresponding AD group. I want allow only users who are members of a sub-sub-folder's group to access it, but i still want to allow the sub folders (B,E) to be browsed by everyone. (i.e. people can see C,D,F,G but cant access their contents)

I hope that makes sense.

I tried to do this:

Edit the permissions of the sub folders (B,E) and turn off "inherited permissions", but copied them rather than removing them. I then set them to not cascade down to children (this folder only).

This mean't that i could create the sub-sub folders (C,D,F,G) but then couldn't access them. This is what i wanted and as i expected. I then planned to add modify rights to the sub-sub folders for their respective groups, and added myself to a couple of the groups to test it out.

However, when i tried to assign the group-modify permission i get a generic "access denied" message. I thought it might be because i didnt have change permission rights on the sub-sub folders, so i modified the sub folders to cascade down "Change permissions" but that didnt help :(

Any ideas why I cant get this to work? I'm in Windows server 2008r1

All the users are Administrators by the way (this has to be the case)

Edit: I don't want to assign deny rights to all the groups that are not allowed to access a particular sub-sub folder as in reality this tree will be massive and that would create a maintenance nightmare!

Thanks.

Answer 1

On Folder A:
Set Everyone to Read & Execute
Set System to Full Control

On Folders B & E:
Enable Inheritance - Remove any explicit permissions

On Folders C, D, F, G:
Disable Inheritance - Remove All Permissions
Set [Corresponding Group] to Modify

Users will be able to override and change these permissions if they are Admins, there's no way around that.