Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Folder Permissions Windows Server 2008R2

Posted on 2014-11-14
11
Medium Priority
?
238 Views
Last Modified: 2014-12-02
Windows Server 2008R2

Our employees routinely move folders on accident.  

We have all of our client folders in the same place, but quite often Client A gets accidentally moved into Client B's folder.  I get that Windows search is the easy solution, haha.  

How can I apply permissions so that they can't move the client's folder any more?  

They should be able to have full permissions to all of Client A's subfolders & files however.  Is this possible?
0
Comment
Question by:2_under_par
  • 5
  • 5
11 Comments
 
LVL 12

Expert Comment

by:Steven Wells
ID: 40443856
hi

you should look to apply read or list folder content permissions to top level folders only. the modify rights underneath. that way the top level folder structure will remain intact.
0
 
LVL 18

Expert Comment

by:awawada
ID: 40444037
Agree Steven if you need more help let us know.
0
 

Author Comment

by:2_under_par
ID: 40450515
With regards to the Top Level Folder, I created Allow & Deny Permissions for a specific group of users.  So, there's 2 separate sets of permissions & when combined are the following... (see the pics for more detail)

Full Control: Deny
Traverse Folder / Execute File:  Allow
List Folder / Read Data: Allow
Read Attributes: Allow
Read Extended Attributes: Allow
Create Files / Write Data: Deny
Create Folders / Append Data: Deny
Write Attributes: Deny
Write Extended Attributes: Deny
Delete Subfolders & files: Deny
Delete: Deny
Read Permissions: Allow
Change Permissions: Deny
Take Ownership: Deny

Unfortunately, when I log in as a user in this group, I can move this folder into another folder.... which is what I am trying to avoid.  Any advice?  Thanks in advance.
Allow-1.png
Allow-2.png
Deny-1.png
Deny-2.png
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
LVL 12

Expert Comment

by:Steven Wells
ID: 40450533
Try not to use any denies. You can use the security tab to view effective permissions to ensure they are what you expect them to be.  Top level only needs to be list folder contents permission
0
 

Author Comment

by:2_under_par
ID: 40450597
OK.  I removed the deletes, & set List Data / Read Data to Allow.  This folder is not inheriting permissions & not passing permission to child folders.  When logging on as a user, the folder is not visible.  Weird.
0
 
LVL 12

Expert Comment

by:Steven Wells
ID: 40450604
You must at least have list otherwise folder won't be viewable by user.  This is called access based enumeration.
0
 

Author Comment

by:2_under_par
ID: 40450624
0
 
LVL 12

Expert Comment

by:Steven Wells
ID: 40450706
Hi,These are templates?  Can you show me what it looks like in the real world? Also show me the advanced tab too?
0
 

Author Comment

by:2_under_par
ID: 40450850
No, sorry, the name of the top level folder is "Template".  I was hoping this folder could be used going forward as a client folder, where the permissions would be the same for every client.  They would just copy the "Template" folder & rename it to the Client name.
0
 
LVL 12

Accepted Solution

by:
Steven Wells earned 2000 total points
ID: 40450931
Ok. That is fine. I think you should be ok. however I suspect the administrator would need to create and edit permissions for all top level folders, as if you just create a new folder, it will inherit permission from the folder above it.

ie, create a new folder with the client name

set the permission not to inherit.

Apply explicit permissions for this folder, but not sub folders

then you can adjust permissions below.

It may not be exactly what you are after but that is how NTFS permissions work.
0
 

Author Closing Comment

by:2_under_par
ID: 40477080
I didn't initially get this to work, because I wasn't applying it to the root folder.  (The one I shared)
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
Measuring Server's processing rate with a simple powershell command. The differences in processing rate also was recorded in different use-cases, when a server in free and busy states.
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question