Sharing permissions doesn't apply to sub directories as required

Question

I have few Windows 2008 Enterprise servers with SP2 on a domain environment. Below is a scenario what I was trying to achieve and where I am stuck with.

I have created certain Security - Global groups and have added members accordingly. Afterwards, I have created a folder called "Departmental" and then some sub folders such as IT, Finance, Corporate... etc.

What I have done initially is just shared the Main directory with read permission for Domain Users as I only require the directory to be seen/accessed by domain authenticated users. However, what I have also done is that, each of the sub folders I have manually added the respective groups be removing the inheritance. Now, when I do this all the domain users can see/access the root directory and also the sub directories belonging to their department (e.g. a finance user can only see/view finance folders, the rest are hidden from user view).

However, they are not able write into the directory regardless of the access. And when I move back and give Contribute access to the Domain Users group, then the users are able write into the sub directories.

I know t his will work out as the other folders aren't visible for them but what I require is, if there's a way to over come this by only giving the read access to the root directory and then to sub directories as required? is this possible or am I doing this wrong?

Answer 1

You've granted everyone the READ permission on the Share. That's all they'll be able to do regardless of your NTFS permissions. Share and NTFS permissions work in tandem to determine the access level of a user when accessing the resource over the network, and the most restrictive combination wins.

You should probably set the Share permissions to Full Control and control access using the NTFS permissions. That's how it's done most of the time.

Answer 2

If you access a share via the network, the share permissions have priority.

If you access the files on the server itself, the NTFS permissions have priority.

For example, if you give Everyone read access to the share, and you give the IT group Modify to the IT subfolder, everyone in the IT group will only be able to read "\\share\IT" because the share's privileges are more restrictive (read only).

If someone in the IT group logs onto the server and accesses that folder, they will be able to modify it.

However, if you give the "Everyone" group Full Control on the share you can now restrict access at the NTFS level.

For example, if you give the IT group Full Control of the IT subfolder then they will have Full Control. Other users will not have Full Control unless you give them that access at the NTFS level.

The share permissions are for the share.

This is why it's common practice to give "Everyone" full control at the share level then only apply the users and groups who need access at the NTFS level.