I have a Windows 2008 R2 Fileserver serving Win and Mac (SMB) clients. I have say 5 folders: Happy Sad Lonely Stinky and Grumpy. All of the folders should be public to domain users except Happy and Sad, which should be restricted to the Happy and Sad security groups (Active Directory). I want everyone with access to be able to create folders and files, but not be able to delete the root shares. They should be able to delete files and folders within the shares though. Also, I want the creator owner of the files and folders to be able to change permissions so that they can restrict a folder they create to a person or group. Inheritance of permissions seems to make this task difficult. Please assist.
What you're looking for is quite possible, but usability is quite a challenge. It can all be done through command line calls (on Windows, your Mac users are going to be out of luck), with varying complexity, but the GUI is entirely in the realm of "Advanced".
Give creator-owner the ability to do whatever they want with created files and directories but not do anything to the top level directory:
That'll create a Grumpy directory where Authenticated Users won't be able to delete Grumpy, but will be able to do almost anything below it, and ANYTHING to anything they actually create.
The restricted group versions are very similar:
The (F) right gives users the ability to do anything, including modify access lists.
As for the rest of your request, this is where the crappy user-factors come into play. As I said, it can be done but training your users to do it right will be a continual challenge (and the Mac users will be out of luck).
A user deciding to lock down a certain folder they created to just the right people:
First step is to block inheritance.
Where it gets really really bad is when you try to do this in one of the restricted directories.
Same workflow, but your users have a problem: They can't start at "happy" and browse down. They have to access the
All of this can be done through the Windows GUI, but icacls makes documenting it much easier.
As I said, can be done. But not what you'd call useable.