Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I feel like I am missing something on something obvious here. Or just making a noob mistake.

I have a folder structure as shown below an example. Folder A1 and A2 are inside folder A. Folder B1, B2 are inside folder A1 and so on.

Folder A
|
|
|
|--------Folder A1
|          |---------Folder B1
|          |---------Folder B2
|--------Folder A2
|          |---------Folder C1
|          |---------Folder C2

I want to create a group permission on folder A that prevent users from creating, deleting, moving a file or folder inside of it (aka cant move or delete A1 and A2 ETC), but not effect anything in Folder A1 or A2.

I created the following rules on Folder A Group A (the one i want to limit).

Name: Group A
Apply to: this folder and subfolders
Deny Create files / write data
Deny Create Folders / append data
Deny Delete subfolders and files
    Deny Delete

Checkmarked: Apply these permissions to objects and/or containers within this container only.

|

Name: Group A
Apply to: This folder, subfolders and files
Allow everything but Full Control, Delete, change permissions, take ownership

Didn't not checkmark: apply these....

I know many people are against the use of Deny permissions because of the fact it can easily override all others. etc. I don't feel intelligently setup Deny rules should be ignored as none-option.

Now the actucal problem occurs inside Folder B1,B2, ETC

Inside B1,B2,C1 ETC i can delete folders, files and move folders inside of other folders. I cant however create folders or files. I also cant move folders into folders B1, B2 ETC(even though i can move out).

When I check the permission on the folders inside of A1 or A2 I see nothing wrong. When I check the permissions ON A1, A2 from A I see the rules only apply to THIS folder and not SUBFOLDERS.

Following MS Technet here: http://technet.microsoft.com/en-us/library/cc776140(v=ws.10).aspx says that when I checkmark " Apply these permissions to objects and/or containers within this" the rules should only apply to subfolders within Folder A and not subsequent folders.

any ideas?

edit: I tried multiple methods including not using deny or any kind of implicit rules.

share|improve this question
    
This is really hard to read/follow. I don't know how you can fix it, but consider giving it a look and seeing how you might make it less of a WALL OF TEXT and streamline what you're trying to get to. –  MDMarra Nov 14 '12 at 18:54

1 Answer 1

up vote 3 down vote accepted

You probably want to break permission inheritance at A and remove the default Users ACL (or maybe not, up to you).

Create an ACL on Folder A for Group A that applies to "This Folder Only" and set it to Read.

Create another ACL on Folder A for Group A that applies to "Subfolders Only and Files" and set it to Modify (or whatever you want).

This will make it so that people in group A cannot change the folder structure directly below A, but can modify anything at a lower level.


As for this:

When I check the permission on the folders inside of A1 or A2 I see nothing wrong. When I check the permissions ON A1, A2 from A I see the rules only apply to THIS folder and not SUBFOLDERS.

Sounds like someone broke inheritance and propagated a different ACL throughout that subfolder structure. You should fix that so that everything below Folder A inherits from Folder A.

Also, in the future, using a folder names the same as a group in your example makes it a little hard for others to follow :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.