I am an AD newbie and have been tasked with this situation: Win 2008 r2 environment, create security groups in AD where root folder has only read access for all; sub folder 1 has read for 1 group public and full for another group; sub folder 2 has no public access and full access for another - no group can change root folders names.

I have a time issue on this. Please help!

  • 1
    I suspect that you were asked to do the sysadmin equivalent of a carpenter's apprentice being asked to fetch the left hand screwdriver. – John Gardeniers Oct 2 '12 at 23:18
  • @JohnGardeniers Why do you say that? This is entirely doable. – MDMarra Oct 2 '12 at 23:18
  • @MDMarra, of course the result is doable at the file level, as per your answer, but not at the AD level, as per the question. – John Gardeniers Oct 2 '12 at 23:22
  • @JohnGardeniers Oh, I just assumed it was jumbled terminology from someone not familiar with the ideas. You're absolutely correct. You create the security groups in AD, but you actually apply them to ACLs on the file server in question. You can't do this 100% in AD. – MDMarra Oct 2 '12 at 23:24
  • @MDMarra, you may well be correct and that it might be a terminology issue but when I first saw it I immediately thought someone was having a bit of fun with the new kid. ;) – John Gardeniers Oct 2 '12 at 23:28

Break NTFS inheritance on the toplevel folder. I'll call it root in this answer. Then grant Authenticated Users - Read to This Folder Only in the advanced view. You might also want to add Administrators - Full Control to This Folder, subfolders, and files so that administrators of the server can still traverse the entire directory tree.

Then, make your two subfolders: folder1 and folder2 in this example. These folders should inherit the Administrators - Full Control ACE, but not the Authenticated Users - Read one. Now, you can just add the groups and grant permissions as needed on the subfolders.

You'll end up with something like this:

-root (Authenticated Users - Read, Administrators - Full)  

----folder1 (Authenticated Users - Read, Group1 - Modify)

----folder2 (Group2 - Modify)

Just as a side note, you almost never want to give Full Control to users, you want to give Modify. This will let them delete, create, rename, etc but giving them Full Control instead allows them to change permissions as well.

  • The NTFS-Fu is strong with this one. – Ryan Ries Oct 3 '12 at 0:13
  • I do what's can – MDMarra Oct 3 '12 at 0:57
  • Except that Modify gives the users the ability to rename the parent folder for each group (not the root folder but the parent folder for each group under the root folder) which sounds like it breaks the OP's requirement about not renaming the root folders, unless I'm reading too much into the question. – joeqwerty Oct 3 '12 at 2:03
  • I thought the requirement was that only the root folder cannot be renamed. You can work around this by giving read to only the subfolder and modify on all subfolders and files in the advanced view. You're right, though. The requirements aren't entirely clear. – MDMarra Oct 3 '12 at 2:16
  • Thank you both for the insight. This newbie definately appreciates the help - regardless of sytax this is an important concern for me. – JRD Oct 3 '12 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.