Assume there's this folder structure:
D:\ --+-- Acctg --+-- Payable | +-- Receivable | +-- Fin --+-- Inv | +-- Tax | +-- Treas | +-- Mrktg --+-- Ads +-- Promo
Users are not allowed to change the structure, but they are free to create & delete files & folders in the leaf nodes (i.e., the rightmost folders).
AGDLP principle said that I should assign permissions on the above folders to DL-Groups. Let's say I have a G-Group of users, G-Accounting-Payable, containing users that have access to the
The way I see it, I have two strategies:
Create three DL-Groups and assign them permissions:
- DL-D-Acctg_T -- allowed traversal of
- DL-D-Acctg-Pay_LF -- allowed listing of
- DL-D-Acctg-Pay__RW -- allowed full permissions to the contents of
Add G-Accounting-Payable as member to all the above DL-Groups
Create just one DL-Group DL-D-Acctg-Pay__RW, and assign it the proper permissions for each level of the folder.
Then, add G-Accounting-Payable as member to that DL-Group.
Which strategy is the Recommended Best Practice, and why?