I'm relatively new to Sys Admin and there is this requirement.. or at least, the talk of a requirement whereby we restrict access to certain folders for a particular set of computers (an OU on our domain that contains a room of PCs). I just don't know if this is possible on active directory. I get the feeling that file system permissions are only designed for user/group mapping and can't figure out how i might go about trying to stop users from modifying these files except in this room (AD container) on these PCs.
Is this possible? Any suggestions are welcome (no matter how left-field).
EDIT: more info is needed it seems...
I'm at a school. The server share that i'm applying permissions to contains files that are used for school reporting functions. I have a series of security groups applied to the share such that the appropriate administrative staff can access the files how they need to and faculty staff can do the same.
In addition to the requirements satisfied in the implementation above, management wants the faculty staff to make changes to these files only in a particular room (such that they can be 'supervised' i believe). I have the AD containers set up for the PCs in this room - i was hoping that there was a group policy solution to this permission predicament.