• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Windows Server odd Folder Permision Problem for Win Admins

S

Shinare

Senior member
Hey all,
I have an odd folder permissions problem that is just beating me up and I can't figure out how to solve the puzzle.

Let me explain what I am trying to do and then let you know what I have done and failed. What I am trying to do is have everyone map a drive that is a shared folder (of course) on a server. BUT, I do not want anyone (except admins of course) to be able to double click on the drive letter and open it up. However, I do want them able to read/write (modify) within sub-folders of that share. So basically:

G: is a mapped drive of \\Server1\Docs

G: \ ---> Appears in "My Computer" but user is unable to open it up. (getting an "Access Denied" dialog box is just fine here)

G: \Subfolder1 ---> User has modify rights (and can even open it by run: G: \Subfolder1 would be fine)
G: \Subfolder1\Sublevel2 ---> Modify.
...etc

I don't care if they type in the run box "G: \Subfolder1" and are able to open that folder and view files. They wont know that folder is there because they cant open G: \ and see the sub-folders. Basically I have a program that needs to read and write from/to sub-folders off the G drive but I don't want users to get in and accidentally delete something by being nosy. (or seeing possibly sensitive data within the files)

Here's what I have tried and failed:
1) Deny "List Folder Contents" permission on the Directory of the share (\\Server1\Docs). This works perfectly except for one thing. What it does right is it blocks people from being able to open G: from "My Computer", and does allow the program to see the sub folders, which is what I want. However, No one can Write/Delete within the sub folders, presumably because Windows needs to be able to "see" the root for some reason. I say that because when I remove the deny list permission on the root folder they are then able to write in sub folders.

2)Deny Traverse Folder permission on \\Server1\Docs directory. This didn't seem to do anything as I was still able to open up the G drive and traverse haphazardly willy-nilly, frolicking through the folders.

3)Deny Traverse Folder Permission on Subfolder1. User was not able to open folder, but was also not able to open any sub folders under it or write/read anything.

Basically, what I have to do right now so that they can use the program is allow read access to the root and then add modify permission specifically to any sub-folders they needs access to. Unfortunately this allows them to double click on the G: drive and frolic throughout the G: drive.

Any Ideas? (and unfortunately I can not change the software they are using that requires this kind of access.)
 
PS> I had to put a space between all the "G: \" because it kept replacing it with an odd smiley face.

PPS> I also forgot to mention that this is Windows Server 2003 R2 and the clients are Windows XP.
 
Last edited:
By default, when you apply an NTFS permission, it applies to all files within the folder and within all subfolders.

However, if you go into the advanced NTFS permissions (which it sounds like you've done), you'll be able to set the scope of the permission. If denying "List Folder Contents" does what you want at the root folder, you should be able to achieve your desired outcome by setting that permission for "this folder only".
 
i'd rather change the NTFS permission to not inherit permission from the parent folder

however, i can't keep from wondering why you trying to do what you trying to do???

why do you want the user to be able to see the the shared folder but not be able to access it?

you could also just simply share the subfolder by itself.
you leave the root share as admin only and enable user r/w perm for the "new" share alas subfolder
 
@theevilsharpie: yah, I actually had it set to that and it seemed to be working correctly, as in not displaying the root, but displaying the sub-folders, except that because windows does not see (read) the root folder it can not for some reason write in the sub folders. It displays the contents of sub folders and allows movement between them, but you can not write in a sub folder without read access to it's root. Its very odd and if that's working as designed, I'm not too sure why its designed to work that way. Very frustrating to have what seems to be a useful permission option to use but you cant use it because it breaks permissions down the line.
 
Last edited:
BoT said:
i'd rather change the NTFS permission to not inherit permission from the parent folder

however, i can't keep from wondering why you trying to do what you trying to do???

why do you want the user to be able to see the the shared folder but not be able to access it?

you could also just simply share the subfolder by itself.
you leave the root share as admin only and enable user r/w perm for the "new" share alas subfolder
Click to expand...

Unfortunately I have a poorly written program everyone uses that expects to find G: \Subfolder1\Sublevel1 and be able to read/write to it. However, I dont want just anyone to be able to browse to it.

My thought was to disable access to the root folder but allow to the subs, but that seems to break write functionality in the subs.
 
yes it does because they inherit permission from the parent folder
you have to disable permission inheritance for the sub folders
 
BoT said:
yes it does because they inherit permission from the parent folder
you have to disable permission inheritance for the sub folders
Click to expand...

No, its actually not inheriting the deny list permission down the line, I have that set to "This folder only". And that's working because down the line a user can list the contents of the sub folders. Its only when I try to write to one of those sub folders that there is a problem. I get a pop-up box that says "Access denied to G: \" its not saying "Access denied to G: \Subfolder1" which is why I think setting the root to deny list permission breaks windows from being able to write to any sub folder under it. (which is stupid IMHO)
 
you don't have to deny them in the parent shared folder, just don't give it r/w perm
then in the sub you give it r/w perm
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top