0

I am an AD newbie and have been tasked with this situation: Win 2008 r2 environment, create security groups in AD where root folder has only read access for all; sub folder 1 has read for 1 group public and full for another group; sub folder 2 has no public access and full access for another - no group can change root folders names.

I have a time issue on this. Please help!

Improve this question
5
  • 1
    I suspect that you were asked to do the sysadmin equivalent of a carpenter's apprentice being asked to fetch the left hand screwdriver.
    – John Gardeniers
    Oct 2, 2012 at 23:18
  • @JohnGardeniers Why do you say that? This is entirely doable.
    – MDMarra
    Oct 2, 2012 at 23:18
  • @MDMarra, of course the result is doable at the file level, as per your answer, but not at the AD level, as per the question.
    – John Gardeniers
    Oct 2, 2012 at 23:22
  • @JohnGardeniers Oh, I just assumed it was jumbled terminology from someone not familiar with the ideas. You're absolutely correct. You create the security groups in AD, but you actually apply them to ACLs on the file server in question. You can't do this 100% in AD.
    – MDMarra
    Oct 2, 2012 at 23:24
  • @MDMarra, you may well be correct and that it might be a terminology issue but when I first saw it I immediately thought someone was having a bit of fun with the new kid. ;)
    – John Gardeniers
    Oct 2, 2012 at 23:28

1 Answer 1

Reset to default
2

Break NTFS inheritance on the toplevel folder. I'll call it root in this answer. Then grant Authenticated Users - Read to This Folder Only in the advanced view. You might also want to add Administrators - Full Control to This Folder, subfolders, and files so that administrators of the server can still traverse the entire directory tree.

Then, make your two subfolders: folder1 and folder2 in this example. These folders should inherit the Administrators - Full Control ACE, but not the Authenticated Users - Read one. Now, you can just add the groups and grant permissions as needed on the subfolders.

You'll end up with something like this:

-root (Authenticated Users - Read, Administrators - Full)  

----folder1 (Authenticated Users - Read, Group1 - Modify)

----folder2 (Group2 - Modify)

Just as a side note, you almost never want to give Full Control to users, you want to give Modify. This will let them delete, create, rename, etc but giving them Full Control instead allows them to change permissions as well.

Improve this answer
5
  • The NTFS-Fu is strong with this one.
    – Ryan Ries
    Oct 3, 2012 at 0:13
  • I do what's can
    – MDMarra
    Oct 3, 2012 at 0:57
  • Except that Modify gives the users the ability to rename the parent folder for each group (not the root folder but the parent folder for each group under the root folder) which sounds like it breaks the OP's requirement about not renaming the root folders, unless I'm reading too much into the question.
    – joeqwerty
    Oct 3, 2012 at 2:03
  • I thought the requirement was that only the root folder cannot be renamed. You can work around this by giving read to only the subfolder and modify on all subfolders and files in the advanced view. You're right, though. The requirements aren't entirely clear.
    – MDMarra
    Oct 3, 2012 at 2:16
  • Thank you both for the insight. This newbie definately appreciates the help - regardless of sytax this is an important concern for me.
    – JRD
    Oct 3, 2012 at 22:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .