2

I'm newer to this, but my Sr. Sys Admin has given me a project and he's currently out of town, and I'm stuck.

We have a file share system set up for each department. For example:

\\server\A - Department A

\\server\B - Department B

\\server\C - Department C

We have department B who needs read/execute access to a single folder inside of share A.

\\server\A\folder1 - Department B needs access

First, I tried creating an AD group called "ShareAReadOnly" and adding Dept B to that group. Then I gave that group 'List' to Share A, and then 'Read/Execute' to 'folder1'.

This works, except that Dept B can now list everything in \server\A. They can't open or read anything, but they can navigate through the share, reading folder names and file names.

EDIT: I also tried only giving read/execute to \server\A\folder1, but then I can't actually map the drive to the department's computers, because it says they don't have access.

Is there a better way for me to do this? My goal is to map the network share A to Dept B, but have them only able to view \server\A\folder1, and not even list anything else.

Sorry for my inexperience, this might be a quickly-solved issue.

2
  • it works that way because they have to be able to navigate to the folder. They wouldn't be able to do that if they can't see the parent folder (unless they linked to it...but not 100% on that). – MikeAWood Jan 27 '15 at 21:18
  • So is there a way to ONLY view the 1 folder, the actual parent folder? Even if I could restrict them so they can't open the other folders on the share, that would be fine. Right now, though, they can navigate through all the different folders on the whole share. – Fubsy Jan 27 '15 at 21:20
4

You should enable Access Based Enumeration on your shares. From Microsoft:

Access-based enumeration displays only the files and folders that a user has permissions to access. If a user does not have Read (or equivalent) permissions for a folder, Windows hides the folder from the user’s view. This feature is active only when viewing files and folders in a shared folder; it is not active when viewing files and folders in the local file system.

https://technet.microsoft.com/en-us/library/dd772681(v=ws.10).aspx

3
  • Thank you for this, it looks like this is what I'm looking for! With this, how would I set the permissions? Would I still give 'list' to the whole share? Or just read/execute to the specific folder? – Fubsy Jan 27 '15 at 21:30
  • Giving the group READ permission on the parent folder should be sufficient AFAIR. – joeqwerty Jan 27 '15 at 21:58
  • That means your permission should be modified to apply to This folder only (the parent folder), otherwise the Read permission would grant users the ability to open (read) all of the files in the parent folder. – I say Reinstate Monica Feb 1 '15 at 2:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.