Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Using Windows Server 2008.

I would like to allow all users to map to a common network drive and be able to browse it. But, I only want them to be able to see the subfolders they actually have access rights to.
Is this doable?

Example
I have a share with two folders on it;
\\domain\share\FolderA
\\domain\share\FolderB

With three different security groups, I would like to map a network drive for all three to \\domain\share. However, for group1, I want them to only be able to see FolderA, group2 should only see FolderB and group3 should see both.
I am not just talking about denying access to the actual folder, which is easy enough, I don't want the user to even be able to see that the folder exists.

In other words, when group 1 logs in and do "dir n:\" they should see
N:\FolderA

When group 2 logs in, they should see
N:\FolderB

and when group 3 logs in they should see
N:\Folder A
N:\Folder B

My half-baked solution
If I completely block access to the root then I can't map a drive to it. I can give everyone the traverse right which then allows the user to map a drive. However, if a member of group1 or group2 tries to go to "N:\" they get an access denied error. If they go to N:\FolderA (for group1) then it works.

So, that sort of works, but it would be nicer if the user could actually browse to N:\ and just only see the subfolders they have access to.

I am pretty sure I have seen this done but not sure how to do it myself. Any advice would be greatly appreciated.

share|improve this question

3 Answers 3

up vote 7 down vote accepted

Most certainly you can do this natively in windows Server 2008. Have a read here:

http://blog.stealthpuppy.com/windows/access-based-enumeration-in-windows-server

share|improve this answer
    
Thanks for this! –  Frans Oct 1 '09 at 14:51
    
Happy to be of service. –  joeqwerty Oct 1 '09 at 14:53
    
There is even an addon for Windows Server 2003 users to enable Access Based Enumeration (at microsoft.com/downloads/…)! (for those searching) I must say, it works wonderfully! –  Joshua Oct 1 '09 at 15:30

This still isn't possible in Windows...I was hoping it would be in 2008 but I think it is a limit of the current version of NTFS itself.

What you are talking about is a great feature of Netware that never bothered to come to fruition (yet) in NTFS.

See here (still after all these years):

http://support.microsoft.com/kb/303758

I'd love to be wrong on this...so hopefully someone will chime in.

share|improve this answer

Second TheCleaner here. This was a great feature of Novell Netware that never got implemented in Windows. Why bother the user with 50 folders they can't access and one they can.

share|improve this answer
1  
I take it all back! –  Tom Bell Oct 2 '09 at 8:04

protected by Chris S Mar 28 '12 at 17:15

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.