Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a scenario involving a Windows file server where the "owner" wants to dole out permissions to a group of users of the following sort:

\\server\dir1\dir2\dir3: Read & Execute and Write \\server\dir1\dir2: No permissions. \\server\dir1: No permissions. \\server: Read & Execute

To my understanding (Update: This entire paragraph is wrong!), it is not possible to do this because Read & Execute permission must be granted to all the parent directories in a directory chain in order for the operating system to be able to "see" the child directories and get to them. Without this permission, you can't even obtain the security context token when trying to access the nested directory, even if you have full access to the subdirectory.

We are looking for ways to get around this, without moving the data from \\server\dir1\dir2\dir3 to \\server\dir4.

One workaround I thought of, but which I am not sure if it will work, is creating some sort of link or junction \\server\dir4 which is a reference to \\server\dir1\dir2\dir3. I am not sure which of the available options (if any) would work for this purpose if the user does not have Read & Execute permission on \\server\dir1\dir2 or \\server\dir1, but as far as I know, the options are these:

  • NTFS Symbolic Link,
  • Junction,
  • Hard Link.

So the questions:

  • Are any of these methods suitable to accomplish my goal?
  • Are there any other methods of linking or indirectly referencing a directory, which I haven't listed above, which might be suitable?
  • Are there any direct solutions that don't involve granting Read & Execute to \\server\dir1 or \\server\dir2 but still allowing access to \\server\dir1\dir2\dir3?
share|improve this question
    
This is possible. The user would see the directory but if not given read permission, can not see the contents of the directory at all, easy enough to setup. –  Ramhound Dec 17 '12 at 17:15
    
That was my question too. Thank you for raising the discussion. And for updating your question to reflect immediately that your assumption was wrong. –  tyron Mar 21 at 12:51

2 Answers 2

up vote 3 down vote accepted

You are mistaken in your original assumption, which renders the rest of your question moot.

The minimum permission that a user would need on dir1 and dir2 is Traverse Directory. This will most likely be problematic to your users, though - so I would recommend Traverse Directory and List Folders. They will be able to navigate through the top two directories and get to dir3 where they have more permissions, but will not even see what files exist in the top two directories.

Permissions like Read & Execute and Modify are just collections of individual permissions. They're the first thing you see, because they're the most commonly used. If you need to get very granular (like this situation), click the Advanced button and dig into the options listed there.

share|improve this answer
    
Excellent information. Thanks a bunch! –  allquixotic Dec 17 '12 at 17:14
    
Excellent information (2)! But there is something I didn't catch up: "This will most likely be problematic to your users, though". Why would it be problematic? The naming is pretty straightforward in the sense that "Traverse" seems the only needed permission. What kind of problems should users expect? –  tyron Mar 21 at 12:50

Amazingly, if the individual has the full path to a subfolder on which they have at least R permissions, they require NO permissions on any of the parent folders, not even traverse. They can simply access it using the UNC. (They must, of course, have read permissions on the share; just not on any folders above the level they want to access).

I didn't believe this when I was told, but testing proves it out.

This is counter to what I thought I knew of permissions in the Windows world, and I suspect will be a surprise to many.

\server\folder1\folder2\folder3

If there are no permissions at all for Bilbo on folder1 and on folder2, but Bilbo has modify (for example) on folder3, \server\folder1\folder2\folder3 will take him right there, no problem.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.