I feel like I am missing something on something obvious here. Or just making a noob mistake.
I have a folder structure as shown below an example. Folder A1 and A2 are inside folder A. Folder B1, B2 are inside folder A1 and so on.
Folder A | | | |--------Folder A1 | |---------Folder B1 | |---------Folder B2 |--------Folder A2 | |---------Folder C1 | |---------Folder C2
I want to create a group permission on folder A that prevent users from creating, deleting, moving a file or folder inside of it (aka cant move or delete A1 and A2 ETC), but not effect anything in Folder A1 or A2.
I created the following rules on Folder A Group A (the one i want to limit).
Name: Group A Apply to: this folder and subfolders Deny Create files / write data Deny Create Folders / append data Deny Delete subfolders and files Deny Delete Checkmarked: Apply these permissions to objects and/or containers within this container only.
Name: Group A Apply to: This folder, subfolders and files Allow everything but Full Control, Delete, change permissions, take ownership Didn't not checkmark: apply these....
I know many people are against the use of Deny permissions because of the fact it can easily override all others. etc. I don't feel intelligently setup Deny rules should be ignored as none-option.
Now the actucal problem occurs inside Folder B1,B2, ETC
Inside B1,B2,C1 ETC i can delete folders, files and move folders inside of other folders. I cant however create folders or files. I also cant move folders into folders B1, B2 ETC(even though i can move out).
When I check the permission on the folders inside of A1 or A2 I see nothing wrong. When I check the permissions ON A1, A2 from A I see the rules only apply to THIS folder and not SUBFOLDERS.
Following MS Technet here: http://technet.microsoft.com/en-us/library/cc776140(v=ws.10).aspx says that when I checkmark " Apply these permissions to objects and/or containers within this" the rules should only apply to subfolders within Folder A and not subsequent folders.
edit: I tried multiple methods including not using deny or any kind of implicit rules.