Permission question on Windows server 2008.

Hello,

We create a DEPARTMENT shared folder on a windows 2008 server E drive. Under the share advanced permission, we grant the domain admins full access and the domain users read and modify access. Under NTFS permission, we setup the same.

We have a sub-folder under the DEPARTMENT share call FINANCE. We only grant the Finance domain group read and write access.

We thought this is okay until we recently find out the domain users group (everybody) can create a file under the root of DEPARTMENT. If we change the domain user group to have only read access to the DEPARTMENT folder in the share permission advance setting, even if we grant the Finance group read and write access in NTFS permission setting, they cannot create any file or folderin the FINANCE folder.

Please advise how this can be fixed.  The goal here to allow the Finance domain group to have r/w access to the FINANCE folder but they are not allowed to create any additional resource under the root of DEPARTMENT.  

Thanks.