Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an existing DFS Replication and Namespace group that we use to serve the company's files.

This has been operating fine for us for some time now, and continues to do so. however a situation arose yesterday afternoon that has led us to be stumped.

The problem is that we have our name space presented as :
\\\public\[8 or 9 folders that are mapped to the users in the business]

We had a problem this morning that meant that a number of users started mapping their AD Home Drive directly to the \\\public directory and we found that they had read/write. This rapidly became a problem as a at least one director saved some moderately sensitive documents in there and basically anyone could read them.

I've tidied up that specific problem with some deft scripting and a slight modification of group policy.

However I would like to make \public read only, the trouble is I can't work out where the ACLs for that folder would be held.

All the folders that are presented as \\\public\[folder] are 'real' folders on logical volumes on our DFS servers so are secured with groups that are applied via the 'security' tab.

I'd like to do the same on \public but I can't find it. I have looked through amongst other things \Sysvol\ but can't find it and after a lot of clicking and a bit of reading I can't see how to lock it down.

Any thoughts?

share|improve this question
up vote 2 down vote accepted

You need to modify the permissions for the namespace folder shared on any namespace servers.

  • Open your DFS Management console, and browse to your domain namespace.
  • Click on the namespace and then choose the Namespace Servers tab from the right hand side.
  • You'll need to set the permissions individually on each namespace server you have enabled.
    • You can do that by right clicking each server hosting the namespace and choosing Properties.
  • Click the Share Permissions button and modify the permissions there.
share|improve this answer
Wonderful. Thank you. I realise I had seen that previously but I'd been too chicken to change it in case it propagated to the shares below. You gave me the confidence I needed. – Patrick Jul 3 '12 at 14:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.