Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Situation: Windows Server 2003 - Users all have a mapped network drive to a common "Shared Files" file share...

  • File Share
    • Level 1 ("Projects" folder)
      • Level 2 (Files in the project folder)

Users have been accidentally moving Level 1 folders into other Level 2 folders. What's the magic combination of permissions to achieve the following:

  • Users should be able to CREATE folders at Level 1.
  • Users should have full control (create/modify/delete) at Level 2.
  • Users should not be able to RENAME, DELETE, or MOVE folders at Level 1.

Edit: The trick here is that after a user creates a folder at level 2, they should automatically have full control at that level; any way to use "this level only' at Level 1 and achieve this?

share|improve this question
Share and NTFS permissions – Terry May 5 '09 at 14:25
up vote 3 down vote accepted

To be able to create level one files, users need to have the Create permission for the file share folder. To prevent them from modifying level 1 folders, they need to be denied the modify permission on the file share folder. User should then be given full control of the level 1 folder to allow them to create, edit and delete level 2 folders.

Hope that makes sense!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.