Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How would I go about creating a file or folder that requires a user to be a member of two or more different groups in order to read/write to the folder?

For example, say I run an auto repair shop, and I have a folder called "Repair History" and I only want people to access it if they are members of BOTH the "Mechanics" and "Cashiers" group? This would be an AND requirment instead of an OR requirement which seems to be the norm.

I know we can create a separate group that is needed to access the folder, but this is more of an academic question, since it pertains to a different security structure that we are creating. I'm not sure if MS security handles it, but I'm wondering how it would be done either way.

share|improve this question
up vote 1 down vote accepted

Generally this isn't possible, but there is one way you could get this effect.

Nest a set of directories, an the set the permissions of each directory for a single group (disable inheritance). If they are not in the first group the cannot traverse the first directory, if they are not in the second group, they cannot get into the second directory. Unfortunately this structure would probably be somewhat confusing to the end-users.

\foo       - only group Mechanics
\foo\bar   - only group Cashiers.
share|improve this answer
Makes sense. We're creating an application where the front end can be adjusted to make things intuitive for the end users, so this strategy might work. Thanks. – David Aug 30 '12 at 17:31

You could probably also do this using a mix of NTFS and Share permissions - give one group access via share permissions, and the other access via NTFS permissions. The folder would have to exist outside of your existing folder structure, though.

share|improve this answer
I do, however, feel the best solution is to create and manage a third group. – Steve G Aug 30 '12 at 17:46
I'm designing my own security model and I want to base in on NTSF, so was just wondering. Thanks. – David Aug 30 '12 at 19:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.