Break NTFS inheritance on the toplevel folder. I'll call it root
in this answer. Then grant Authenticated Users - Read
to This Folder Only
in the advanced view. You might also want to add Administrators - Full Control
to This Folder, subfolders, and files
so that administrators of the server can still traverse the entire directory tree.
Then, make your two subfolders: folder1
and folder2
in this example. These folders should inherit the Administrators - Full Control
ACE, but not the Authenticated Users - Read
one. Now, you can just add the groups and grant permissions as needed on the subfolders.
You'll end up with something like this:
-root (Authenticated Users - Read, Administrators - Full)
----folder1 (Authenticated Users - Read, Group1 - Modify)
----folder2 (Group2 - Modify)
Just as a side note, you almost never want to give Full Control to users, you want to give Modify. This will let them delete, create, rename, etc but giving them Full Control instead allows them to change permissions as well.