Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having trouble coming up with a solution to this one, maybe because I don't know enough about how Windows ACLs work.

I have two folders, let's call them Directory A and Directory B. These are contained within another directory.

The users that are supposed to see Folder B are in an AD group; Group B. It's not practical to put everyone else in a different group - this is for just a few out of 1000 users.

I just want the users who are in the group to see Folder B, and Everybody Else to just see Folder A.

How should I set up my permissions?

(In case this is relevant, these folders are for Start Menu shortcuts for users whose Start Menu is redirected to a network location via GP.)

share|improve this question
up vote 6 down vote accepted

It sounds like you need Access-based enumeration, which is a fancy way of saying "if you don't have access to it, you can't see it".

See here.

share|improve this answer
I'd be hesitant to use this as it looks like it was last updated in 2005, and isn't widely supported. – Adam Brand Jul 2 '09 at 19:10
It's a pretty simple feature, how much updating could it really need? It's still around in Server 2008 FWIW. I assume you meant "widely used" rather than "widely supported", since its not really something thats so complex it requires special application support. – ThatGraemeGuy Jul 2 '09 at 19:29

So far as I'm aware, you can't use permissions to determine which folder a group can see. You can use Deny to keep a group from accessing the folder, but it'll still be visible.

share|improve this answer
So maybe I'm approaching the problem from the wrong direction. Maybe I should put the workstations that need Folder B in a separate OU and redirect their Start Menu to a different location. – Doug Chase Jul 2 '09 at 17:36
You beat me to it... Also, since he's using these folders as part of the Start Menu, users might get an Access Denied error when they click the Start button. – Anthony Lewis Jul 2 '09 at 17:36
Took the words out of, fingers, Doug. – Kara Marfia Jul 2 '09 at 17:40
I was trying to avoid that but it is what I shall do! Thanks for stopping by :) – Doug Chase Jul 2 '09 at 17:47
You can restrict what's visible based on permissions, see my answer below. – ThatGraemeGuy Jul 2 '09 at 18:54

In the advanced security settings for folder B turn off inheritance. Create a group for the folder B users. Assign this group rights to the folder.

share|improve this answer

So you would give read access to AD group B and remove all other groups. Then you would allow all read for folder A.

Do you need group B not to see folder A?

share|improve this answer
Yeah, I just want group B to see folder B, and not folder A, but I want group A to see folder A and not folder B. – Doug Chase Jul 2 '09 at 17:34
So you would need two groups. Deny takes precedence over read so you can't just deny all and allow some. – MathewC Jul 2 '09 at 17:37

Maybe, only grand Group B for folder B, and deny Group B for Folder A. All groups should be assigned on the parent folder.

Hope it helps.

share|improve this answer

What you want is the Access Based Enumeration feature in Server 2008 or 2008 R2, it will allow you to hide a folder from a user as you have requested.

See MVP Blog post for more info.

Also, you can install the ABE add-on for Server 2003 if you're not running Server 2008.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.