How do you grant read-only permissions on NTFS Security settings?

Question

Is it possible to create a security group that can read who has permission to do what on NTFS folders but without granting Full Control or letting the group open files within those folders?

Answer 1

The minimum permission required to read a folder's permissions (DACL) is READ_CONTROL ("Read Permission"). If you also want to be able to view the folder's subfolders, FILE_LIST_DIRECTORY ("List Folder") is required.

But beware: When set on a directory, FILE_LIST_DIRECTORY gives you the right to list the children, but when set on a file it allows you to read the content.

So you probably want to use FILE_LIST_DIRECTORY+READ_CONTROL, set that on a root directory and have the permissions apply (inherit) to subfolders only, but not to files.

With SetACL you could set such permissions like this:

SetACL -on PathToDirectory -ot file -actn ace -ace n:UserOrGroup;p:list_dir,read_dacl;i:so

Answer 2

Hi I think you want just the List Folder Contents permission.

While this article is for windows XP the table is a good chart of special permissions.

http://support.microsoft.com/kb/308419

List Folder/Read Data The List Folder permission allows or denies the user from viewing file names and subfolder names in the folder. The List Folder permission applies only to folders and affects only the contents of that folder. This permission is not affected if the folder that you are setting the permission on is listed in the folder list.