How do you setup permissions on a Windows NTFS share so that users (in a AD group)

1) can read any file on that share, if they know the full path to the file

2) can't browse/list any folder on that share

The idea is to use the file path as "access token" to the file.


The Bypass Traverse Checking user right is what allows a user to access files in a path where they don't have permissions in the path except for the files/folders that they have explicit permissions on. By default, the Everyone security group is granted this right. All you need to do is give the user permissions on the files that you want them to access. They can then access those files directly if they know the full path to those files.

  • joeqwerty thanks for your answer, unfortunately it does not work for me. In my test scenario I create as owner: mkdir D:\_tmp\ashare\test\d1\d2 echo content> D:\_tmp\asharetest\d1\t.txt echo content> D:\_tmp\asharetest\d1\d2\t.txt If I open the share with read access to Everyone, everyone can browse in the path. How do I open the share so that my users can't browse in the shared tree? – JuergenP Dec 18 '12 at 10:08
  • You have to remove any NTFS permissions that will grant the user acceess to the folders in the path (such as Users, Domain Users, Everyone, Authenticated Users) from the permissions in the path and grant the user permissions only on the files they need access to. – joeqwerty Dec 18 '12 at 14:48
  • Joe, I took a slightly different route to solve my problem, with a lot of trial and error, -> see my answer - anyhow thank you for your thoughts, it really helped. – JuergenP Dec 18 '12 at 15:34

Here is the solution that finally works for me, with the help of @joequerty pointing me in the right direction:

assume a folder sh to be shared

1) share folder sh "read only" for Everyone (\\host\sh)

2) give read/execute permission on sh for Everyone, but apply to files only.

assume we have a file in sh\a\b\c\f.txt

3) give only to (immediate parent) folder c

Read/Execute, Read and List Folder permissions for Everyone and apply to This folder only

Now \\host\sh\a\b\c\f.txt is accessible to Everyone

dir \\host\sh\a\b\c will list f.txt

dir \\host\sh\a\b and higher up will lead nowhere

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.