Generally you want to apply your restrictions at the NTFS level. Make your share permissions as open as you can (i.e 'Authenticated Users' or 'Everyone' modify access at least) then nail it down with the NTFS security permissions.
I would recommend creating three security groups for each share (Read, Modify and Write) and then assign the permissions for those to the folder. You then add users and groups into those groups to apply permissions. Saves having to edit folder permissions every time a user change role.
If you want to hide folders that users cannot see you will need to enable 'Access Based Enumeration' so in your case I would:
- Create a single share called 'Dropbox' and apply 'Everyone' write access
- Create the relevant folders with 3 security groups each (Read, Write and Modify) you can just create two (Read and Write) if you want to simplify.
- Assign the groups to the folders and give them the permissions stated
- Go to 'Server Manager' on the file server and 'File and Storage Services --> Shares --> Right click the share --> Properties --> Settings --> Enable Access Based Enumeration'
What ABE does is hide any resources that the user does not have at least 'Read / List' access to.
Just a thought, but applying Write or Modify permissions at the root folder level (i.e Public in your example) will also allow the users to modify the parent folder. So someone may accidentally rename 'Public' to something else.
To work around this, for the groups with modify permissions (so Write and Modify) set a separate permission for 'Read, write and execute' as 'This folder only' then have 'Modify' Permissions 'Subfolders and files' for example our department drive has the following:
So you can see there are three ACL's but only two groups.
The first one is:
FS.dep.Full.Information Systems - Modify - Subfolders and files
Which allows all members of the group to create and endit all object UNDER the current folder.
FS.dep.Full.Information Systems - Read and Execute - This folder only
Which allows the group to only READ the parent folder (Information Systems) but not make any changes to it.
FS.dep.Read.Information Systems - Modify - This folder, subfolders and Files
Which just gives read access to everything and everyone in the group.