This has probably been asked elsewhere, but I can't find a question that meets the exact criterion we have.
We have a Windows Server 2016 Standard system which runs fileshares. Inside one of the shares, we have a folder (for the purposes of this example, the share is called "GeneralShare" and the folder is "ControlledFolder") in there. We would like to have the folder itself listed in the share, but not permit any user not in the "ControlledFolderAccess" group in AD to have access to the data. Therefore, any user not in the "ControlledFolderAccess" group would know the folder exists but not be able to see the content inside it. (We also have implicit access rules such as the system and local admins (and Domain Admins) having permission as well.)
We've experimented with a set of permissions, adjusting read/write/execute and all the iterations of special permissions in-between, and also experimented with the 'deny' permissions as well. However, we've not found the proper set of rules that would properly encompass the rules.
Does anyone know the specific rules we need to set to prevent users from entering into the directory but still see that the directory exists in the share itself?
This is what we did in a test directory to try and replicate:
GeneralShare Permissions:
ALLOW RULES:
- Domain Admins: Full Control
- Local system Administrators: Full Control
- Domain users: Modify
- SYSTEM user: Full Control
DENY RULES:
- NONE
GeneralShare/ControlledFolder Rules:
(NO INHERITENCE)
ALLOW RULES:
- Domain Admins: Full Control
- Local system administrators: Full Control
- ControlledFolderAccess: Full Control
As I understand it, these permissions should work... are we missing a Deny rule somewhere, or has the standard behaviro for Server 2016 just changed? (These same permissions on a 2012R2 server that has other shares on it work as expected, we can see the folder but not access it if we're not an admin and don't have explicit access or are not in the ControlledFolderAccess group... but in 2016, these folders just don't show up with these permissions set)