Is it possbile to prevent a directory from being listed in Windows?

Question

I'm using Windows Home Server 2011 and connecting to it with various Windows 7 version clients.

Suppose I have a shared directory (or server folder) mydir on my WHS box which contains a subdirectory private. When a given client lists the contents of mydir, is it possible to instruct WHS to display private only if the given user is authorized? It's easy enough to prevent access to private but I don't even want it listed.

Note that marking the directory as hidden is not at all what I want to do since that would also force an authorized user to change the viewing state of hidden directoies and files and could be easily undermined by anyone that can list the contents of mydir.

Answer 1

Using Access Based Enumeration correctly will do exactly what you want (in fact, that's what it's made for), but I'm not having much luck finding good information on usage in WHS 2011 in particular. This blog post indicates all the ways that ABE can be enabled (or not), and this StackOverflow question indicates that ABE is available in WHS 2011.

Answer 2

I don't have experience with Home Server, but Windows file sharing in general does not provide that capability. (EDIT: Looks like Home Server does offer that functionality) If you look at the file sharing permissions, you can assign a user a permission of Read, or Read/Write. That's it. There are a lot more permissions available to local accounts, but even those don't allow to not list a certain folder.

The only thing I can think of that would prevent the user of seeing it would be to use FTP where you can have much finer control over what a user has access to thanks to virtual directories.

One thing that you might want to try is to have a different share folder for regular users versus a private user. The directory for regular users would have all the files. For the private user, you could have another folder that uses junction points (mklink) to point to the main folder, then has the "private" folder separate inside. I'm not sure if using junction points link this would work for SMB, but it might work.