up vote 1 down vote favorite
share [g+] share [fb]

I'm having trouble coming up with a solution to this one, maybe because I don't know enough about how Windows ACLs work.

I have two folders, let's call them Directory A and Directory B. These are contained within another directory.

The users that are supposed to see Folder B are in an AD group; Group B. It's not practical to put everyone else in a different group - this is for just a few out of 1000 users.

I just want the users who are in the group to see Folder B, and Everybody Else to just see Folder A.

How should I set up my permissions?

(In case this is relevant, these folders are for Start Menu shortcuts for users whose Start Menu is redirected to a network location via GP.)

link|improve this question
68% accept rate
feedback

6 Answers

up vote 6 down vote accepted

It sounds like you need Access-based enumeration, which is a fancy way of saying "if you don't have access to it, you can't see it".

See here.

link|improve this answer
I'd be hesitant to use this as it looks like it was last updated in 2005, and isn't widely supported. – Adam Brand Jul 2 '09 at 19:10
It's a pretty simple feature, how much updating could it really need? It's still around in Server 2008 FWIW. I assume you meant "widely used" rather than "widely supported", since its not really something thats so complex it requires special application support. – Graeme Donaldson Jul 2 '09 at 19:29
feedback
up vote 2 down vote

So far as I'm aware, you can't use permissions to determine which folder a group can see. You can use Deny to keep a group from accessing the folder, but it'll still be visible.

link|improve this answer
So maybe I'm approaching the problem from the wrong direction. Maybe I should put the workstations that need Folder B in a separate OU and redirect their Start Menu to a different location. – Doug Chase Jul 2 '09 at 17:36
You beat me to it... Also, since he's using these folders as part of the Start Menu, users might get an Access Denied error when they click the Start button. – Anthony Lewis Jul 2 '09 at 17:36
Took the words out of my...er, fingers, Doug. – Kara Marfia Jul 2 '09 at 17:40
I was trying to avoid that but it is what I shall do! Thanks for stopping by :) – Doug Chase Jul 2 '09 at 17:47
2  
You can restrict what's visible based on permissions, see my answer below. – Graeme Donaldson Jul 2 '09 at 18:54
show 1 more comment
feedback
up vote 1 down vote

In the advanced security settings for folder B turn off inheritance. Create a group for the folder B users. Assign this group rights to the folder.

link|improve this answer
feedback
up vote 1 down vote

So you would give read access to AD group B and remove all other groups. Then you would allow all read for folder A.

Do you need group B not to see folder A?

link|improve this answer
Yeah, I just want group B to see folder B, and not folder A, but I want group A to see folder A and not folder B. – Doug Chase Jul 2 '09 at 17:34
So you would need two groups. Deny takes precedence over read so you can't just deny all and allow some. – MathewC Jul 2 '09 at 17:37
feedback
up vote 1 down vote

Maybe, only grand Group B for folder B, and deny Group B for Folder A. All groups should be assigned on the parent folder.

Hope it helps.

link|improve this answer
feedback
up vote 1 down vote

What you want is the Access Based Enumeration feature in Server 2008 or 2008 R2, it will allow you to hide a folder from a user as you have requested.

See MVP Blog post for more info.

Also, you can install the ABE add-on for Server 2003 if you're not running Server 2008.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.