how to prevent direct access to DFS Namespace shared folders

Question

I have made a DFS Namespace named \\dc1\bank. There are some other folders from another file servers(for example \\dc1\bank\folder1 is the folder on \\fs1\folder1). I want to restrict users to direct access to folders on the other file servers (for example: restricting to direct access to \\fs1\folder1 ). Can I do this in windows server 2008 R2 ?

Answer 1

Just set give the users Traverse Directory only on \\dc1\bank and they'll only be able to navigate the directory. If you don't give them List Folder/Read Data, then they won't even be able to see anything in it.

Then just give them whatever permissions they need on \\fs1\folder1 and map it to the users however you normally would (GPO, logon script, email the link, etc). The security model is identical to how you would solve this problem without DFS.

Answer 2

From what I've seen it doesn't make any difference what they do. If you have shared, say, \server\docs as \org\docs then accessing \someother-server\docs is remapped to the dfs share on all servers.

Not sure how they do this, but this is what I see on every system I've installed with dfs so far.

Answer 3

There is simply no way of doing what you want to do. Since DFS is just a referal to the actual server, not a pass through.

When a user accesses \dc1\bank he is redirected to the dfs target. The data is not feed through dc1!

You could use a $ share. That way the user doesn't see it immediatily when accessing \fs1.

But when you right-click e.g. on the network drive, the user can see where \dc1\bank points to. Then they can access the dollar share.