2

I'm trying to create folder with specific permissions on a server share, lets say the path is \\srv\foo\dir.

  • foo is the parent folder that already has permissions.
  • dir is the folder that I am setting permissions for.

I have three groups, which I've listed below.

  • A - A group with full allowed access to the \\srv\foo.
  • B - A group with full denied access to the \\srv\foo.
  • C - The group I am trying to add permissions for.

I am trying to make Group C able to create, delete, move (etc) files and folders in dir, but have no access or allow permissions in foo.

Currently, foo has permissions to grant Group A full access, and to deny Group B all access. There isn't currently anything for Group C.

I have tried turning inheritance off, but even though I have allowed Group C full access in dir I'm still receiving an access denied message when trying to create a folder as a user in Group C.

I've heard that Windows Permissions value deny permissions before allow, but Group C doesn't have any "deny" permissions set in foo or dir.

Could somebody explain where I am going wrong, or if I have any misconceptions with how these permissions work and that what I am doing is (im)possible?

Thank you.

|improve this question|||||
  • Can you add some screenshots? – duenni Sep 26 '17 at 12:17
  • Unfortunately not as it isn't a virtual network, and I have used those group names and folder structures as examples to make things simpler! Screenshots may make it appear to be a little bit more overwhelming, but the problem is as is specified, I've just tried to filter all of the non-important stuff out. – Nat Sep 28 '17 at 7:52
  • The problem with filtering stuff out is that you may filter out something important along with the non-important stuff. – womble♦ Oct 5 '17 at 4:45
0

This only works with NTFS permissions as we have the root of a share and a folder below that and they share the share permissions, i.e. they are the same as we only talk about one share!

You need to give group C only traverse folder NTFS permissions on \\srv\foo and edit (or what ever you had in mind) permissions on \\srv\foo\dir.

This way they can reach their folder dir without accessing the contents of foo.

Note: Never give users Full control on regular network shares/folders. They will (by accident) destroy your acls. In this scenario that would be a user editing a file/dir permission for \\srv\foo\otherFileOrFolder and adding e.g. everyone.

Note 2: avoid deny where possible. There is only a very limit valid use case for it.

|improve this answer|||||
  • Thanks very much, you explained it brilliantly and it worked perfectly! – Nat Oct 6 '17 at 11:55
0

Common practice is to set the share permission for Everyone to Full Control. Then you use NTFS to effectively control all security on that folder.

It sounds like you are already onto the concept of role groups vs security groups. Just to reiterate, best practice is to add users to role groups (for example Accounting). And security groups are added to NTFS permissions (example FolderA-ReadWrite). Then you would add the Accounting role group to the FolderA-ReadWrite security group.

For dir,

  • Share Permission: Everyone-Full Control
  • NTFS Permission: Group A with read/write
  • Add group C as a member of Group A
  • I would create another group D of users that need to be denied and add that group to group B.
    Then add group B and set deny NTFS permissions.
    This would work, but it's best to avoid denys whenever possible. It isn't wrong, but it can make troubleshooting a lot harder. I've found it's best to re-arrange folder structure if possible so that only permits are used.

Here is a Microsoft document regarding how to use share and NTFS permissions
Share and NTFS Permissions on a File Server
Quote:"Another approach is to set share permissions to Full Control for the Everyone group and to rely entirely on NTFS permissions to restrict access."

|improve this answer|||||
-2

"The minimum permission that a user would need on dir1 and dir2 is Traverse Directory. This will most likely be problematic to your users, though - so I would recommend Traverse Directory and List Folders. They will be able to navigate through the top two directories and get to dir3 where they have more permissions, but will not even see what files exist in the top two directories."

"Amazingly, if the individual has the full path to a subfolder on which they have at least R permissions, they require NO permissions on any of the parent folders, not even traverse. They can simply access it using the UNC. (They must, of course, have read permissions on the share; just not on any folders above the level they want to access).

I didn't believe this when I was told, but testing proves it out."

https://superuser.com/questions/520537/give-access-to-a-subdirectory-without-giving-access-to-parent-directories

|improve this answer|||||
  • Sorry for the late reply. I've tried sharing \foo\dir as you said, and have granted permissions on that folder (both in "Properties > Security" and "Properties > Sharing > Advanced Sharing > Permissions") to give Group C full access, but I'm still having troubles with a "you need permissions to perform this action" message. – Nat Sep 28 '17 at 7:50
  • I added a picture of what you need to do. Unless I misunderstood what you're trying to do this will work I have done it. It will allow whoever has share access to \\srv\foo to have access to the dir directory through that share. Map \\srv\dir to the users who you only want access to the dir folder. -- If NTFS permissions have been messed with to much, just copy everything to a new folder and create new shares from that. Be sure to grant the 'Everybody' group read+write or full control on NTFS permissions on the highest parent folder. – person Sep 29 '17 at 11:30
  • This will give you way more shares than necessary. it will break e.g. linked documents between members of different groups. It will also not scale at all. Use NTFS permissions and don't use share permissions to limit at all. – Jonathan Oct 4 '17 at 14:25
  • After managing file servers used by 3,000 people for the last 4 years I'd say the opposite. The granular access provided by NTFS isn't needed in 99% of use cases and the added complexity adds administrative overhead. It creates a NTFS inheritance nightmare especially in a multi-administrator environment. Since share permissions don't inherit, it removes that possibility. Never had a user asked for link documents/ folders, there are probably better solutions if that sort of collaboration is needed. But I updated my post with the assumption that NTFS is required, it's been asked before. – person Oct 5 '17 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.