• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2903
  • Last Modified:

Folder Permissions for Shares in Server 2012

Alright, I must be making a simple mistake here.
I have a new File Server I am configuring running Windows Server 2012.
We have some Shares that should be read only for everyone, except a few users.
I have read that best practice indicates leaving the Share security settings to Allow-Everyone-Full Control.

Under NTFS Permissions I add the user group all my users belong to and give them Read and Execute Permissions (Travers folder / execute file, List folder / read data, Read attributes, Read extended attributes, Read permissions).
This rule applies to Folder, Subfolders, and Files on the share.
I then add myself to have Full Control.

My issue is users still have the following rights I don't want them to have-
Create Files / write data and Create folders / append data.

This Share contains files/folders/subfolders all users should Not have any form of write access too.

What simple thing am I missing or mixing up folks?
I'm trying to avoid using too many Deny permissions, but is that the only easy way to get this to work? Leave the Share as Full Control for Everyone, then explicitly Deny the User's group the correct Write permissions?

Thanks,
Josh
0
Josh-IT
Asked:
Josh-IT
1 Solution
 
Brad BouchardInformation Systems Security OfficerCommented:
All you need to do is give Everyone full share permissions, then give the users who you want to access the actual folders and their files Read permissions.  Easiest way to do this is to right click the top level folder and select properties, sharing tab, advanced sharing, Permissions button, Everyone full control, Ok, Ok, then click Share buton, select users group you want, then give them Read access.
0
 
Josh-ITAuthor Commented:
Thanks xBouchardx, that seems to have corrected my problem!
When using the New Share Wizard in Server Manager, it brings you to a step for setting permissions, where you have a Share Tab, and a Permissions Tab.
Do you know how I could do what you explained above using that method as well?
Under Share, I have Everyone, All, Full Control.
Under Permissions I have the users group set to Read & Execute.
Yet users can still create Files/Folders.
I guess I'm just trying to understand the difference in the two methods since it seems doing it during the initial Share Creation should work just the same.

Update-
Alright, I set Share tab as Read Only for Everyone during initial share creation. And under Permissions I set the main user group to have Read & Execute.
Looks like that works for restricting users.
However, since my user is part of the general user group, even though I Add my user to Permissions and add Full Control, I'm still restricted from all Write Functions.
If I add myself to the Share Tab with Full Control, all seems to work as I want.
So I guess I am looking to understand the difference between the Share Tab and the typical NTFS settings in the Permissions tab.
Sorry for the long response.

Thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Microsoft Azure 2017

Azure has a changed a lot since it was originally introduce by adding new services and features. Do you know everything you need to about Azure? This course will teach you about the Azure App Service, monitoring and application insights, DevOps, and Team Services.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now