Solved

Folder Permissions Windows Server 2008R2

Posted on 2014-11-14
11
221 Views
Last Modified: 2014-12-02
Windows Server 2008R2

Our employees routinely move folders on accident.  

We have all of our client folders in the same place, but quite often Client A gets accidentally moved into Client B's folder.  I get that Windows search is the easy solution, haha.  

How can I apply permissions so that they can't move the client's folder any more?  

They should be able to have full permissions to all of Client A's subfolders & files however.  Is this possible?
0
Comment
Question by:2_under_par
  • 5
  • 5
11 Comments
 
LVL 12

Expert Comment

by:Steven Wells
ID: 40443856
hi

you should look to apply read or list folder content permissions to top level folders only. the modify rights underneath. that way the top level folder structure will remain intact.
0
 
LVL 18

Expert Comment

by:awawada
ID: 40444037
Agree Steven if you need more help let us know.
0
 

Author Comment

by:2_under_par
ID: 40450515
With regards to the Top Level Folder, I created Allow & Deny Permissions for a specific group of users.  So, there's 2 separate sets of permissions & when combined are the following... (see the pics for more detail)

Full Control: Deny
Traverse Folder / Execute File:  Allow
List Folder / Read Data: Allow
Read Attributes: Allow
Read Extended Attributes: Allow
Create Files / Write Data: Deny
Create Folders / Append Data: Deny
Write Attributes: Deny
Write Extended Attributes: Deny
Delete Subfolders & files: Deny
Delete: Deny
Read Permissions: Allow
Change Permissions: Deny
Take Ownership: Deny

Unfortunately, when I log in as a user in this group, I can move this folder into another folder.... which is what I am trying to avoid.  Any advice?  Thanks in advance.
Allow-1.png
Allow-2.png
Deny-1.png
Deny-2.png
0
Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

 
LVL 12

Expert Comment

by:Steven Wells
ID: 40450533
Try not to use any denies. You can use the security tab to view effective permissions to ensure they are what you expect them to be.  Top level only needs to be list folder contents permission
0
 

Author Comment

by:2_under_par
ID: 40450597
OK.  I removed the deletes, & set List Data / Read Data to Allow.  This folder is not inheriting permissions & not passing permission to child folders.  When logging on as a user, the folder is not visible.  Weird.
0
 
LVL 12

Expert Comment

by:Steven Wells
ID: 40450604
You must at least have list otherwise folder won't be viewable by user.  This is called access based enumeration.
0
 

Author Comment

by:2_under_par
ID: 40450624
0
 
LVL 12

Expert Comment

by:Steven Wells
ID: 40450706
Hi,These are templates?  Can you show me what it looks like in the real world? Also show me the advanced tab too?
0
 

Author Comment

by:2_under_par
ID: 40450850
No, sorry, the name of the top level folder is "Template".  I was hoping this folder could be used going forward as a client folder, where the permissions would be the same for every client.  They would just copy the "Template" folder & rename it to the Client name.
0
 
LVL 12

Accepted Solution

by:
Steven Wells earned 500 total points
ID: 40450931
Ok. That is fine. I think you should be ok. however I suspect the administrator would need to create and edit permissions for all top level folders, as if you just create a new folder, it will inherit permission from the folder above it.

ie, create a new folder with the client name

set the permission not to inherit.

Apply explicit permissions for this folder, but not sub folders

then you can adjust permissions below.

It may not be exactly what you are after but that is how NTFS permissions work.
0
 

Author Closing Comment

by:2_under_par
ID: 40477080
I didn't initially get this to work, because I wasn't applying it to the root folder.  (The one I shared)
0

Featured Post

Flexible connectivity for any environment

The KE6900 series can extend and deploy computers with high definition displays across multiple stations in a variety of applications that suit any environment. Expand computer use to stations across multiple rooms with dynamic access.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question