Avatar of finkeltron
finkeltron
Flag for United States of America asked on

Custom NTFS permissions

Is it possible to configure windows file permissions on an AD network to exclude users from writing to directories outside a folder. i.e. users can only put files inside a folder. No stray files. My clients is particular about file management Ascetics. He wants all files to be inside of folders. He instants that it can be done and has seen it. I'm not so sure?
2012-07-08-1829.png
Microsoft Server OSActive Directory

Avatar of undefined
Last Comment
yo_bee

8/22/2022 - Mon
kevinhigg

NTFS permissions can be applied very granularly.  To accomplish this, you would grant the appropriate groups read access at the parent folder (D:\Projects\PROJECTS\Current), while Administrators would likely have full control.  And then within one or more of the subfolders, the specified groups would be granted modify, change, full control perms as appropriate.  In this scenario, an admin (or someone with higher authority) would need to create new folders at the top level.  Is this what he has in mind, or does he want the users to have access to create folders?  Best of luck!
yo_bee

To add to Kevinhigg:
So from the root folder that you want only listing and nothing else and Read/Write to all child objects.
ie
Folder_Parent
Folder_Child_A
Folder_Child_B
Folder_Child_C

To accomlish this you will need to access the Advance Security Settings of the Parent Folder
Once in the Advance security settings you will want to remove the inheritance of Parent folder. You will be prompted to copy or remove the groups and users.  I recommend copy to preserve any admin NTFS settings.  Once copied I then would remove any groups that are not supposed to even access the parent folder.  Next you will need to make two settings.  One for THIS FOLDER ONLY and another for SUBFOLDERS and FILES.
Parent folder settings:
This Folder Only
Traverse,List, Read
SubFolders and Files
Subfolder and Files
All settings accept Full, Take Owership and change Permission

123456789
finkeltron

ASKER
I think i'm starting to figure it out but now I need to change permissions on a group of folders inside one folder. If I highlight multiple folders and get properties there is no securities tab? Seems like I would have to edit each folder induvidually? This would be crazy if there are hundreds of folders to modify.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
kevinhigg

That is awesome detail, yo_bee!  If you review screenshot #9 above, you'll see the solution to this concern.  When setting the permissions at the parent, you can specify that users have specific access to subfolders and files only.  If you wanted all of the folders to have the same permissions, you would likely also select the 2nd checkbox to force propagate the new permissions down through the hierarchy.  Kind regards!
finkeltron

ASKER
I think this still allows users to create folders and files outside a sub folder? I guess to simplify things If users are only allowed to create files in specific folders and administrators create the folders that would be acceptable.
finkeltron

ASKER
I found a PS command that makes this really easy. Just configure one folder with all the permissions then run this command

PS C:\> get-acl c:\foldername | set-acl c:\foldername\*

I can't believe how easy this was! The * will apply a folder's permission set to thousands of folders. Boom done!
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
finkeltron

ASKER
I've requested that this question be closed as follows:

Accepted answer: 0 points for finkeltron's comment #38165444

for the following reason:

I found a solution my own problem which was superior to anything suggested.
yo_bee

The ntfs solution I gave does not allow users to create outside the parent folder.  Not sure why you think it does

I object to the soul solution as being a powershell statement. I think what both Kevin and I offered up is a viable solution.  For you to say that yours is superior is questionable.
yo_bee

Also what about future folders ?
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
kevinhigg

Based on the original question regarding feasibility, and the great detail provided by yo_bee, I would suggest that this be closed by accepting yo_bee's comment http:#a38165313.  Best of luck!
yo_bee

I appreciate the points, but i think it is only ar that they be split between Kevin and myself.
finkeltron

ASKER
My solution was far simpler. Accomplished in a single command.
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
ASKER CERTIFIED SOLUTION
yo_bee

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.