Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Folder Permissions Windows Server 2008R2

Posted on 2014-11-14
11
Medium Priority
?
234 Views
Last Modified: 2014-12-02
Windows Server 2008R2

Our employees routinely move folders on accident.  

We have all of our client folders in the same place, but quite often Client A gets accidentally moved into Client B's folder.  I get that Windows search is the easy solution, haha.  

How can I apply permissions so that they can't move the client's folder any more?  

They should be able to have full permissions to all of Client A's subfolders & files however.  Is this possible?
0
Comment
Question by:2_under_par
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 5
11 Comments
 
LVL 12

Expert Comment

by:Steven Wells
ID: 40443856
hi

you should look to apply read or list folder content permissions to top level folders only. the modify rights underneath. that way the top level folder structure will remain intact.
0
 
LVL 18

Expert Comment

by:awawada
ID: 40444037
Agree Steven if you need more help let us know.
0
 

Author Comment

by:2_under_par
ID: 40450515
With regards to the Top Level Folder, I created Allow & Deny Permissions for a specific group of users.  So, there's 2 separate sets of permissions & when combined are the following... (see the pics for more detail)

Full Control: Deny
Traverse Folder / Execute File:  Allow
List Folder / Read Data: Allow
Read Attributes: Allow
Read Extended Attributes: Allow
Create Files / Write Data: Deny
Create Folders / Append Data: Deny
Write Attributes: Deny
Write Extended Attributes: Deny
Delete Subfolders & files: Deny
Delete: Deny
Read Permissions: Allow
Change Permissions: Deny
Take Ownership: Deny

Unfortunately, when I log in as a user in this group, I can move this folder into another folder.... which is what I am trying to avoid.  Any advice?  Thanks in advance.
Allow-1.png
Allow-2.png
Deny-1.png
Deny-2.png
0
Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

 
LVL 12

Expert Comment

by:Steven Wells
ID: 40450533
Try not to use any denies. You can use the security tab to view effective permissions to ensure they are what you expect them to be.  Top level only needs to be list folder contents permission
0
 

Author Comment

by:2_under_par
ID: 40450597
OK.  I removed the deletes, & set List Data / Read Data to Allow.  This folder is not inheriting permissions & not passing permission to child folders.  When logging on as a user, the folder is not visible.  Weird.
0
 
LVL 12

Expert Comment

by:Steven Wells
ID: 40450604
You must at least have list otherwise folder won't be viewable by user.  This is called access based enumeration.
0
 

Author Comment

by:2_under_par
ID: 40450624
0
 
LVL 12

Expert Comment

by:Steven Wells
ID: 40450706
Hi,These are templates?  Can you show me what it looks like in the real world? Also show me the advanced tab too?
0
 

Author Comment

by:2_under_par
ID: 40450850
No, sorry, the name of the top level folder is "Template".  I was hoping this folder could be used going forward as a client folder, where the permissions would be the same for every client.  They would just copy the "Template" folder & rename it to the Client name.
0
 
LVL 12

Accepted Solution

by:
Steven Wells earned 2000 total points
ID: 40450931
Ok. That is fine. I think you should be ok. however I suspect the administrator would need to create and edit permissions for all top level folders, as if you just create a new folder, it will inherit permission from the folder above it.

ie, create a new folder with the client name

set the permission not to inherit.

Apply explicit permissions for this folder, but not sub folders

then you can adjust permissions below.

It may not be exactly what you are after but that is how NTFS permissions work.
0
 

Author Closing Comment

by:2_under_par
ID: 40477080
I didn't initially get this to work, because I wasn't applying it to the root folder.  (The one I shared)
0

Featured Post

How Blockchain Is Impacting Every Industry

Blockchain expert Alex Tapscott talks to Acronis VP Frank Jablonski about this revolutionary technology and how it's making inroads into other industries and facets of everyday life.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question