I have made a DFS Namespace named \\dc1\bank. There are some other folders from another file servers(for example \\dc1\bank\folder1 is the folder on \\fs1\folder1). I want to restrict users to direct access to folders on the other file servers (for example: restricting to direct access to \\fs1\folder1 ). Can I do this in windows server 2008 R2 ?
Just set give the users
Traverse Directory only on \\dc1\bank and they'll only be able to navigate the directory. If you don't give them
List Folder/Read Data, then they won't even be able to see anything in it.
Then just give them whatever permissions they need on \\fs1\folder1 and map it to the users however you normally would (GPO, logon script, email the link, etc). The security model is identical to how you would solve this problem without DFS.
There is simply no way of doing what you want to do. Since DFS is just a referal to the actual server, not a pass through.
When a user accesses \dc1\bank he is redirected to the dfs target. The data is not feed through dc1!
You could use a $ share. That way the user doesn't see it immediatily when accessing \fs1.
But when you right-click e.g. on the network drive, the user can see where \dc1\bank points to. Then they can access the dollar share.