Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do you setup permissions on a Windows NTFS share so that users (in a AD group)

1) can read any file on that share, if they know the full path to the file

2) can't browse/list any folder on that share

The idea is to use the file path as "access token" to the file.

share|improve this question

The Bypass Traverse Checking user right is what allows a user to access files in a path where they don't have permissions in the path except for the files/folders that they have explicit permissions on. By default, the Everyone security group is granted this right. All you need to do is give the user permissions on the files that you want them to access. They can then access those files directly if they know the full path to those files.

share|improve this answer
joeqwerty thanks for your answer, unfortunately it does not work for me. In my test scenario I create as owner: mkdir D:\_tmp\ashare\test\d1\d2 echo content> D:\_tmp\asharetest\d1\t.txt echo content> D:\_tmp\asharetest\d1\d2\t.txt If I open the share with read access to Everyone, everyone can browse in the path. How do I open the share so that my users can't browse in the shared tree? – JuergenP Dec 18 '12 at 10:08
You have to remove any NTFS permissions that will grant the user acceess to the folders in the path (such as Users, Domain Users, Everyone, Authenticated Users) from the permissions in the path and grant the user permissions only on the files they need access to. – joeqwerty Dec 18 '12 at 14:48
Joe, I took a slightly different route to solve my problem, with a lot of trial and error, -> see my answer - anyhow thank you for your thoughts, it really helped. – JuergenP Dec 18 '12 at 15:34
up vote 0 down vote accepted

Here is the solution that finally works for me, with the help of @joequerty pointing me in the right direction:

assume a folder sh to be shared

1) share folder sh "read only" for Everyone (\\host\sh)

2) give read/execute permission on sh for Everyone, but apply to files only.

assume we have a file in sh\a\b\c\f.txt

3) give only to (immediate parent) folder c

Read/Execute, Read and List Folder permissions for Everyone and apply to This folder only

Now \\host\sh\a\b\c\f.txt is accessible to Everyone

dir \\host\sh\a\b\c will list f.txt

dir \\host\sh\a\b and higher up will lead nowhere

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.