Using access based enumeration on shared folders. Permissions required?

I have a windows 2003 AD/domain environment.  The structure that I'm trying to create is to have a folder called "shared" with departmental directories underneath it.  For example \\server\shared\marketing, \\server\shared\finance, and \\server\shared\everyone.  The key is, I want to map all users to \\server\shared and have them only be able to "see" the folders underneath that they have access to - which I will grant via group objects.  For example a user in the finance group would be able to access \\server\shared\finance - but wouldn't even be able to see \\server\shared\marketing.

I've downloaded and enabled access based enumeration already on this folder.

I'm looking for the correct permission and share settings to make the above possible.

Your thoughts?

Who is Participating?
aissimConnect With a Mentor Commented:
You should go to each folder underneath the shared folder (finance, marketing, etc.) - go to the security tab, click the Advanced button, then uncheck the "Allow inheritable permissions from the parent to propogate to this object...". You'll be prompted to Copy or Remove the current, inherited, permissions - I recommend copying them and then back on the Security tab adjusting the ACL to your departmental needs.

At this point they won't be able to see folders they don't have access to. Good luck!
have a check through this guide - these guys are pretty good at explaining most concepts
You'd set it up as if you weren't using ABE.

Same share and ntfs permissions apply.  The only difference is they can only see what they have permissions to.

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

mikeshaverAuthor Commented:
Jay: Thanks, but that is exactly what I've already done.  

Netman:  I'm with you on this one, but I assume I don't have the share and security permissions correct.  

What is happening now is I have given rights to "read" at the \\server\shared\ folder to all my users.  This enables them to click on the \\server\shared folder without getting an "access denied" message.  However, the access is permeating down to all folders within the \\server\shared folder.  So if a user goes to \\server\shared folder, they see all the folders beneath it.  This is exactly what I do NOT want.

I don't really want to individually share out every subfolder in the \\server\shared folder...but is that what I need to do?  Should I share them, then enable ABE on every subfolder?

Share permissions = Authenticated Users - Full Control.
NTFS permissions = Administrators, SYSTEM = Full Control
                               Authenticated Users = Modify

Sub folders to be set as you normally would.

Since users need to be able to Modify their own stuff, then Inheritance should be allowed - just tighten up the security on the top level departmental folders so people can't delete things they shouldn't.

mikeshaverAuthor Commented:
Thanks guys.  I am off for a week but I will try this when I return and report back.

mikeshaverAuthor Commented:
Thanks everyone.

I ended up sharing out the "top level" called Shared to Authenticated users and the Administrators Group.  Then at each sub folder I set the permissions to whatever group required the access.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.