I have a windows 2008 server with file server role. Multiple shared folders are there, one for each group, so that each group has access to its own folder, but is denied access to other shared folders.

How do I go about granting access to users who belong to more than one group to all their respective folders ?

For example, if Group 1 has only access to Folder 1 and Group 2 has only access to Folder 2, how do a grant access to both Folder 1 and Folder 2 to a user that belongs to Group 1 and Group 2 ?

I haven't succeded so far and I've read that :

[...] if a user is a member of a group where full control is provided over a folder, and also a member of a second group where full control is specifically denied, the user will be denied full control regardless of the fact that it was granted in the first group.

(from TechTopia)

  • 4
    Stop using 'Deny' permissions, only add the groups that need access to the permissions on each folder and add your user to both appropriate groups. And read up on NTFS permissions. The deny entries are almost certainly unnecessary. – BlueCompute Aug 3 '15 at 10:18

BlueCompute is right, but here is why:

'Deny' will usurp any 'grant' permissions, that is the point of deny permissions. By default a users dosn't have access to a resource it hasn't been granted access to. But if you grant it wide access and want to pin hole a resource and deny access, you use deny.

  • 3
    Yeah, the important point for you, ychaouche, is that you don't need to use 'Deny' to prevent a group from having access to a resource. You prevent them from accessing it by simply not granting them any permissions at all on the resource, NOT by adding a Deny entry. – BlueCompute Aug 3 '15 at 12:37
  • 1
    Agree with BlueCompute. Deny permissions should be used very sparingly and only in specific use cases. This is certainly not one of those cases. To prevent users or groups from accessing resources means making sure that they don't have any permissions (direct or inherited). Not by applying the Deny permission but by not applying any Allow permissions. – joeqwerty Aug 3 '15 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.