Is it possible to configure windows file permissions on an AD network to exclude users from writing to directories outside a folder. i.e. users can only put files inside a folder. No stray files. My clients is particular about file management Ascetics. He wants all files to be inside of folders. He instants that it can be done and has seen it. I'm not so sure? 2012-07-08-1829.png
Microsoft Server OSActive Directory
Last Comment
yo_bee
8/22/2022 - Mon
kevinhigg
NTFS permissions can be applied very granularly. To accomplish this, you would grant the appropriate groups read access at the parent folder (D:\Projects\PROJECTS\Current), while Administrators would likely have full control. And then within one or more of the subfolders, the specified groups would be granted modify, change, full control perms as appropriate. In this scenario, an admin (or someone with higher authority) would need to create new folders at the top level. Is this what he has in mind, or does he want the users to have access to create folders? Best of luck!
yo_bee
To add to Kevinhigg:
So from the root folder that you want only listing and nothing else and Read/Write to all child objects.
ie
Folder_Parent
Folder_Child_A
Folder_Child_B
Folder_Child_C
To accomlish this you will need to access the Advance Security Settings of the Parent Folder
Once in the Advance security settings you will want to remove the inheritance of Parent folder. You will be prompted to copy or remove the groups and users. I recommend copy to preserve any admin NTFS settings. Once copied I then would remove any groups that are not supposed to even access the parent folder. Next you will need to make two settings. One for THIS FOLDER ONLY and another for SUBFOLDERS and FILES.
Parent folder settings:
This Folder Only
Traverse,List, Read
SubFolders and Files
Subfolder and Files
All settings accept Full, Take Owership and change Permission
finkeltron
ASKER
I think i'm starting to figure it out but now I need to change permissions on a group of folders inside one folder. If I highlight multiple folders and get properties there is no securities tab? Seems like I would have to edit each folder induvidually? This would be crazy if there are hundreds of folders to modify.
That is awesome detail, yo_bee! If you review screenshot #9 above, you'll see the solution to this concern. When setting the permissions at the parent, you can specify that users have specific access to subfolders and files only. If you wanted all of the folders to have the same permissions, you would likely also select the 2nd checkbox to force propagate the new permissions down through the hierarchy. Kind regards!
finkeltron
ASKER
I think this still allows users to create folders and files outside a sub folder? I guess to simplify things If users are only allowed to create files in specific folders and administrators create the folders that would be acceptable.
finkeltron
ASKER
I found a PS command that makes this really easy. Just configure one folder with all the permissions then run this command
I've requested that this question be closed as follows:
Accepted answer: 0 points for finkeltron's comment #38165444
for the following reason:
I found a solution my own problem which was superior to anything suggested.
yo_bee
The ntfs solution I gave does not allow users to create outside the parent folder. Not sure why you think it does
I object to the soul solution as being a powershell statement. I think what both Kevin and I offered up is a viable solution. For you to say that yours is superior is questionable.
Based on the original question regarding feasibility, and the great detail provided by yo_bee, I would suggest that this be closed by accepting yo_bee's comment http:#a38165313. Best of luck!
yo_bee
I appreciate the points, but i think it is only ar that they be split between Kevin and myself.
finkeltron
ASKER
My solution was far simpler. Accomplished in a single command.