Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to create a security group that can read who has permission to do what on NTFS folders but without granting Full Control or letting the group open files within those folders?

share|improve this question
up vote 1 down vote accepted

The minimum permission required to read a folder's permissions (DACL) is READ_CONTROL ("Read Permission"). If you also want to be able to view the folder's subfolders, FILE_LIST_DIRECTORY ("List Folder") is required.

But beware: When set on a directory, FILE_LIST_DIRECTORY gives you the right to list the children, but when set on a file it allows you to read the content.

So you probably want to use FILE_LIST_DIRECTORY+READ_CONTROL, set that on a root directory and have the permissions apply (inherit) to subfolders only, but not to files.

With SetACL you could set such permissions like this:

SetACL -on PathToDirectory -ot file -actn ace -ace n:UserOrGroup;p:list_dir,read_dacl;i:so

share|improve this answer
Thank you for the advice. Will test. Your SetACL tool looks interesting also. – Chum Feb 21 '11 at 21:12
Please consider marking useful and/or correct answers as such (at the left of each answer). – Helge Klein Feb 21 '11 at 22:08
Done - thanks again. When my rep goes up I will upvote your answer too. :) – Chum Feb 22 '11 at 4:35
what is the difference between List Folder and Traverse Folder in this context? – eft Feb 24 '11 at 22:45
Please open a new thread for new questions. Anyway, here is the answer: "For folders: The Traverse Folder permission applies only to folders. This permission allows or denies the user from moving through folders to reach other files or folders, even if the user has no permissions for the traversed folders. Traverse Folder takes effect only when the group or user is not granted the Bypass Traverse Checking user right. The Bypass Traverse Checking user right checks user rights in the Group Policy snap-in." [From] – Helge Klein Feb 25 '11 at 10:54

Hi I think you want just the List Folder Contents permission.

While this article is for windows XP the table is a good chart of special permissions.

List Folder/Read Data The List Folder permission allows or denies the user from viewing file names and subfolder names in the folder. The List Folder permission applies only to folders and affects only the contents of that folder. This permission is not affected if the folder that you are setting the permission on is listed in the folder list.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.