1

How do you setup permissions on a Windows NTFS share so that users (in a AD group)

1) can read any file on that share, if they know the full path to the file

2) can't browse/list any folder on that share

The idea is to use the file path as "access token" to the file.

Improve this question

2 Answers 2

Reset to default
0

The Bypass Traverse Checking user right is what allows a user to access files in a path where they don't have permissions in the path except for the files/folders that they have explicit permissions on. By default, the Everyone security group is granted this right. All you need to do is give the user permissions on the files that you want them to access. They can then access those files directly if they know the full path to those files.

Improve this answer
3
  • joeqwerty thanks for your answer, unfortunately it does not work for me. In my test scenario I create as owner: mkdir D:\_tmp\ashare\test\d1\d2 echo content> D:\_tmp\asharetest\d1\t.txt echo content> D:\_tmp\asharetest\d1\d2\t.txt If I open the share with read access to Everyone, everyone can browse in the path. How do I open the share so that my users can't browse in the shared tree?
    – JuergenP
    Dec 18, 2012 at 10:08
  • You have to remove any NTFS permissions that will grant the user acceess to the folders in the path (such as Users, Domain Users, Everyone, Authenticated Users) from the permissions in the path and grant the user permissions only on the files they need access to.
    – joeqwerty
    Dec 18, 2012 at 14:48
  • Joe, I took a slightly different route to solve my problem, with a lot of trial and error, -> see my answer - anyhow thank you for your thoughts, it really helped.
    – JuergenP
    Dec 18, 2012 at 15:34
0

Here is the solution that finally works for me, with the help of @joequerty pointing me in the right direction:

assume a folder sh to be shared

1) share folder sh "read only" for Everyone (\\host\sh)

2) give read/execute permission on sh for Everyone, but apply to files only.

assume we have a file in sh\a\b\c\f.txt

3) give only to (immediate parent) folder c

Read/Execute, Read and List Folder permissions for Everyone and apply to This folder only

Now \\host\sh\a\b\c\f.txt is accessible to Everyone

dir \\host\sh\a\b\c will list f.txt

dir \\host\sh\a\b and higher up will lead nowhere

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .