Firstly apologies if some of my terminology is off, I'm pretty new to Windows networking and Active Directory.
We're running a Windows Server 2008R2 fileserver and I've been tasked with restructuring one of our network shares. The share by default is to be accessible by all authenticated users, with a few folders (e.g.
\\share\manager_2) to be restricted to just certain people (
manager_2). I also want those folders to not be visible to users who do not have access to them - Access Based Enumeration has worked wonders for this. So far so good.
Now the issue arises when a manager wishes to create a sub-folder within their own folder (
\\share\manager_1\sub_folder_1) and share this folder with another user. We've given the managers the ability to set their own permissions on folders within the managers own folder, so
manager_1 can giver
user_1 access to
\\share\manager_1\sub_folder_1, HOWEVER in this scenario:
user_1cannot navigate down the share directory tree to
\\share\manager_1\sub_folder_1because the 'list folders' permission isn't automatically granted for them on
\\share\manager_1- so Access Based Enumeration hides the
manager_1folder from them.
Even with with 'traverse folders' permission user_1 cannot directly go to the
\\share\manager_1\sub_folder_1UNC path, ABE takes precedence over 'traverse folders'.
Really I want a way to get ABE working but with 'reverse permission' propagation of the 'list folders' permission - such that in the above scenario,
user_1 would be able to drill down the directory tree to
sub_folder_1 BUT not be able to see any of the contents of the
manager_1 folder (bar obviously
Having spent a good few hours trying to work out how to do this my understanding is there is a feature called 'Dynamic Inheritance' in Novell's equivalent to Active Directory that does exactly this. Is there any way I can achieve this in a Windows based environment?
Any help much appreciated.