0

This has probably been asked elsewhere, but I can't find a question that meets the exact criterion we have.

We have a Windows Server 2016 Standard system which runs fileshares. Inside one of the shares, we have a folder (for the purposes of this example, the share is called "GeneralShare" and the folder is "ControlledFolder") in there. We would like to have the folder itself listed in the share, but not permit any user not in the "ControlledFolderAccess" group in AD to have access to the data. Therefore, any user not in the "ControlledFolderAccess" group would know the folder exists but not be able to see the content inside it. (We also have implicit access rules such as the system and local admins (and Domain Admins) having permission as well.)

We've experimented with a set of permissions, adjusting read/write/execute and all the iterations of special permissions in-between, and also experimented with the 'deny' permissions as well. However, we've not found the proper set of rules that would properly encompass the rules.

Does anyone know the specific rules we need to set to prevent users from entering into the directory but still see that the directory exists in the share itself?

This is what we did in a test directory to try and replicate:

GeneralShare Permissions:

ALLOW RULES:

  • Domain Admins: Full Control
  • Local system Administrators: Full Control
  • Domain users: Modify
  • SYSTEM user: Full Control

DENY RULES:

  • NONE

GeneralShare/ControlledFolder Rules:

(NO INHERITENCE)

ALLOW RULES:

  • Domain Admins: Full Control
  • Local system administrators: Full Control
  • ControlledFolderAccess: Full Control

As I understand it, these permissions should work... are we missing a Deny rule somewhere, or has the standard behaviro for Server 2016 just changed? (These same permissions on a 2012R2 server that has other shares on it work as expected, we can see the folder but not access it if we're not an admin and don't have explicit access or are not in the ControlledFolderAccess group... but in 2016, these folders just don't show up with these permissions set)

Improve this question
5
  • Give read permissions to "everybody" to its root x:\rootFolder\ and lock everybody from entering the GeneralShare. - x:\rootFolder\GeneralShare – aPugLife Feb 16 '18 at 15:51
  • I'm not understanding the problem. Is it that users CAN enter the folder or is it that users CAN NOT see the folder? – joeqwerty Feb 16 '18 at 16:27
  • @joeqwerty they currently cannot see the folder exists and cannot enter it. We want them to be able to see that the folder exists, but not be able to enter it. The permissions i specified above work in an older Pre-2016 server that runs some of the shares, but in the newer 2016 server environment it doesn't behave that way anymore. – Thomas Ward Feb 16 '18 at 17:25
  • OK, then it sounds like Access Based Enumeration is enabled on the parent share, which prevents users from seeing folders that they don't have permissions to. If you disable ABE on the parent share that should allow them to see, but not access, the folder in question. – joeqwerty Feb 16 '18 at 17:27
  • @joeqwerty that actually was the problem. If you post it as an answer on how to switch that on/off I'll accept it as the answer. (The only thing I had to do on my end was cycle logins for my user account on my computer where I was testing permissions access with another user, that made the system recognize ABE was not enabled...) – Thomas Ward Feb 16 '18 at 17:45
0

It sounds like Access Based Enumeration is enabled on the parent share, which prevents users from seeing folders that they don't have permissions to. If you disable ABE on the parent share that should allow them to see, but not access, the folder in question.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.