Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have made a DFS Namespace named \\dc1\bank. There are some other folders from another file servers(for example \\dc1\bank\folder1 is the folder on \\fs1\folder1). I want to restrict users to direct access to folders on the other file servers (for example: restricting to direct access to \\fs1\folder1 ). Can I do this in windows server 2008 R2 ?

share|improve this question
    
I think you would just need to set the permissions to disallow those users to logon to the machine who's folders you don't want them to access directly. Then they can only access through the share, thats my thoughts. –  Chris Marisic Nov 14 '11 at 13:39

3 Answers 3

Just set give the users Traverse Directory only on \\dc1\bank and they'll only be able to navigate the directory. If you don't give them List Folder/Read Data, then they won't even be able to see anything in it.

Then just give them whatever permissions they need on \\fs1\folder1 and map it to the users however you normally would (GPO, logon script, email the link, etc). The security model is identical to how you would solve this problem without DFS.

share|improve this answer
    
thank you Mark but my issue is that i want users can access to the "\\fs1\folder1" just by typing "\\dc1\bank" (i have don this by DFSn).the problem is i want to prevent accessing to "\\fs1\folder1" by direct typing "\\fs1\folder1". is this issue need any third party applications? again thank to all. –  arash Nov 16 '11 at 6:01
    
Oh, in that case you can't do that. When you go to the dfs path, there is a transparent link to the server path. What you're asking for isn't possible. –  MDMarra Nov 16 '11 at 11:48

From what I've seen it doesn't make any difference what they do. If you have shared, say, \server\docs as \org\docs then accessing \someother-server\docs is remapped to the dfs share on all servers.

Not sure how they do this, but this is what I see on every system I've installed with dfs so far.

share|improve this answer

There is simply no way of doing what you want to do. Since DFS is just a referal to the actual server, not a pass through.

When a user accesses \dc1\bank he is redirected to the dfs target. The data is not feed through dc1!

You could use a $ share. That way the user doesn't see it immediatily when accessing \fs1.

But when you right-click e.g. on the network drive, the user can see where \dc1\bank points to. Then they can access the dollar share.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.