2

I'm newer to this, but my Sr. Sys Admin has given me a project and he's currently out of town, and I'm stuck.

We have a file share system set up for each department. For example:

\\server\A - Department A

\\server\B - Department B

\\server\C - Department C

We have department B who needs read/execute access to a single folder inside of share A.

\\server\A\folder1 - Department B needs access

First, I tried creating an AD group called "ShareAReadOnly" and adding Dept B to that group. Then I gave that group 'List' to Share A, and then 'Read/Execute' to 'folder1'.

This works, except that Dept B can now list everything in \server\A. They can't open or read anything, but they can navigate through the share, reading folder names and file names.

EDIT: I also tried only giving read/execute to \server\A\folder1, but then I can't actually map the drive to the department's computers, because it says they don't have access.

Is there a better way for me to do this? My goal is to map the network share A to Dept B, but have them only able to view \server\A\folder1, and not even list anything else.

Sorry for my inexperience, this might be a quickly-solved issue.

2
  • it works that way because they have to be able to navigate to the folder. They wouldn't be able to do that if they can't see the parent folder (unless they linked to it...but not 100% on that).
    – MikeAWood
    Jan 27, 2015 at 21:18
  • So is there a way to ONLY view the 1 folder, the actual parent folder? Even if I could restrict them so they can't open the other folders on the share, that would be fine. Right now, though, they can navigate through all the different folders on the whole share.
    – Fubsy
    Jan 27, 2015 at 21:20

1 Answer 1

4

You should enable Access Based Enumeration on your shares. From Microsoft:

Access-based enumeration displays only the files and folders that a user has permissions to access. If a user does not have Read (or equivalent) permissions for a folder, Windows hides the folder from the user’s view. This feature is active only when viewing files and folders in a shared folder; it is not active when viewing files and folders in the local file system.

https://technet.microsoft.com/en-us/library/dd772681(v=ws.10).aspx

3
  • Thank you for this, it looks like this is what I'm looking for! With this, how would I set the permissions? Would I still give 'list' to the whole share? Or just read/execute to the specific folder?
    – Fubsy
    Jan 27, 2015 at 21:30
  • Giving the group READ permission on the parent folder should be sufficient AFAIR.
    – joeqwerty
    Jan 27, 2015 at 21:58
  • That means your permission should be modified to apply to This folder only (the parent folder), otherwise the Read permission would grant users the ability to open (read) all of the files in the parent folder. Feb 1, 2015 at 2:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .