Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I feel like I am missing something obvious here. Or just making a noob mistake.

I have a folder structure as shown in the example below. Folder A1 and A2 are inside folder A. Folders B1, B2 are inside folder A1 and so on.

Folder A
|
|
|
|--------Folder A1
|          |---------Folder B1
|          |---------Folder B2
|--------Folder A2
|          |---------Folder C1
|          |---------Folder C2

I want to create a group permission on folder A that prevents users from creating, deleting or moving a file or folder inside of it (i.e. they can't move or delete A1 and A2, etc.), but not affect anything in Folder A1 or A2.

I created the following rules on Folder A Group A (the one i want to limit).

Rule:

Name: Group A
Apply to: this folder and subfolders
    Deny Create files / write data
    Deny Create Folders / append data
    Deny Delete subfolders and files
    Deny Delete

Checkmarked: Apply these permissions to objects and/or containers within this container only.

Rule:

Name: Group A
Apply to: This folder, subfolders and files
Allow everything but Full Control, Delete, change permissions, take ownership

NOT checkmarked: Apply these permissions to objects and/or containers within this container only.

I know many people are against the use of Deny permissions because of the fact it can easily override all others. etc. But I don't feel intelligently set up Deny rules should be ignored as a non option.

Now the actual problem occurs inside Folders B1, B2, etc.

Inside B1, B2, C1, etc. I can delete folders/files and move folders inside of other folders. I can't however create folders or files. I also can't move folders into folders B1, B2, etc. (Even though I can them move out).

When I check the permission on the folders inside of A1 or A2 I see nothing wrong. When I check the permissions ON A1, A2 from A I see the rules only apply to THIS folder and not SUBFOLDERS.

A Microsoft Article (TechNet: Selecting where to apply permissions) says that when I checkmark "Apply these permissions to objects and/or containers within this" the rules should only apply to subfolders within Folder A and not subsequent folders.

Any ideas?

Edit: Note: I tried multiple methods including not using Deny or any kind of implicit rules.

share|improve this question
    
This is really hard to read/follow. I don't know how you can fix it, but consider giving it a look and seeing how you might make it less of a WALL OF TEXT and streamline what you're trying to get to. –  MDMarra Nov 14 '12 at 18:54
    
@MDMarra: I tried to reformat the post a bit. (I am not the original author.) –  StackzOfZtuff Jun 9 at 12:36

1 Answer 1

up vote 3 down vote accepted

You probably want to break permission inheritance at A and remove the default Users ACL (or maybe not, up to you).

Create an ACL on Folder A for Group A that applies to "This Folder Only" and set it to Read.

Create another ACL on Folder A for Group A that applies to "Subfolders Only and Files" and set it to Modify (or whatever you want).

This will make it so that people in group A cannot change the folder structure directly below A, but can modify anything at a lower level.


As for this:

When I check the permission on the folders inside of A1 or A2 I see nothing wrong. When I check the permissions ON A1, A2 from A I see the rules only apply to THIS folder and not SUBFOLDERS.

Sounds like someone broke inheritance and propagated a different ACL throughout that subfolder structure. You should fix that so that everything below Folder A inherits from Folder A.

Also, in the future, using a folder names the same as a group in your example makes it a little hard for others to follow :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.