# Requiring mulitple group membership in order to access folder

How would I go about creating a file or folder that requires a user to be a member of two or more different groups in order to read/write to the folder?

For example, say I run an auto repair shop, and I have a folder called "Repair History" and I only want people to access it if they are members of BOTH the "Mechanics" and "Cashiers" group? This would be an AND requirment instead of an OR requirement which seems to be the norm.

I know we can create a separate group that is needed to access the folder, but this is more of an academic question, since it pertains to a different security structure that we are creating. I'm not sure if MS security handles it, but I'm wondering how it would be done either way.

-

Generally this isn't possible, but there is one way you could get this effect.

Nest a set of directories, an the set the permissions of each directory for a single group (disable inheritance). If they are not in the first group the cannot traverse the first directory, if they are not in the second group, they cannot get into the second directory. Unfortunately this structure would probably be somewhat confusing to the end-users.

\foo       - only group Mechanics
\foo\bar   - only group Cashiers.

-
Makes sense. We're creating an application where the front end can be adjusted to make things intuitive for the end users, so this strategy might work. Thanks. –  David Aug 30 '12 at 17:31

You could probably also do this using a mix of NTFS and Share permissions - give one group access via share permissions, and the other access via NTFS permissions. The folder would have to exist outside of your existing folder structure, though.

-
I do, however, feel the best solution is to create and manage a third group. –  Steve G Aug 30 '12 at 17:46
I'm designing my own security model and I want to base in on NTSF, so was just wondering. Thanks. –  David Aug 30 '12 at 19:52