I have few Windows 2008 Enterprise servers with SP2 on a domain environment. Below is a scenario what I was trying to achieve and where I am stuck with.

I have created certain Security - Global groups and have added members accordingly. Afterwards, I have created a folder called "Departmental" and then some sub folders such as IT, Finance, Corporate... etc.

What I have done initially is just shared the Main directory with read permission for Domain Users as I only require the directory to be seen/accessed by domain authenticated users. However, what I have also done is that, each of the sub folders I have manually added the respective groups be removing the inheritance. Now, when I do this all the domain users can see/access the root directory and also the sub directories belonging to their department (e.g. a finance user can only see/view finance folders, the rest are hidden from user view).

However, they are not able write into the directory regardless of the access. And when I move back and give Contribute access to the Domain Users group, then the users are able write into the sub directories.

I know t his will work out as the other folders aren't visible for them but what I require is, if there's a way to over come this by only giving the read access to the root directory and then to sub directories as required? is this possible or am I doing this wrong?


You've granted everyone the READ permission on the Share. That's all they'll be able to do regardless of your NTFS permissions. Share and NTFS permissions work in tandem to determine the access level of a user when accessing the resource over the network, and the most restrictive combination wins.

You should probably set the Share permissions to Full Control and control access using the NTFS permissions. That's how it's done most of the time.

  • Thank for the explanation. Giving out full control on to the root of share will also have write access to it which I don't want, instead allow them to write into the sub directories. I remember a similar set-up that was done on a 2012 by one of my colleague had worked like a charm.. Couldn't figure out where else I would need to alter. :/ – AzkerM Apr 11 '16 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.