3

I have 3 groups Electricalgrp, Plumbinggrp, & Payrollgrp that need access to sub-folders in a network share named Data.

Shared folder Data and sub-folders:

 Data
  |
  +--Electrical
  +--Plumbing
  +--Payroll

Basically, this is what I am trying to accomplish:

  1. Data share restricted to Read only, don't want anyone creating files or folders in the root of the Data share.
  2. Electricalgrp should be able to create,delete, and modify folders and files in the Electrical folder but not be able to delete the Electrical folder.
  3. Plumbinggrp should be able to create,delete, and modify folders and files in the Plumbing folder but not be able to delete the Plumbing folder.
  4. Payrollgrp should be able to create,delete, and modify folders and files in the Payroll folder but not be able to delete the Payroll folder.

I have tried the following share permissions and NTFS security settings:

Share              Permissions                    NTFS Security     Result

Data               Full control,Read,Change       Read              Works fine

Folders NTFS Security(disabled inheritance)

Folder        Group               NTFS Security                  Result

Electrical    Electricalgrp       Modify             NO GOOD, able to delete folder
Electrical    Plumbinggrp         Deny, Read         Works, denies access to folder
Electrical    Payrollgrp          Deny, Read         Works, denies access to folder

I did the same thing to the other two folders, I just changed deny and modify to it's respective groups.

Everything works great except the part that prevent the group from deleting the main folder that they are a member of. How do I prevent that?

1

You can grant your users Modify access to your "top-level" subfolders but prevent them from deleting (and consequently, renaming) the folder by applying the following two permission sets:

For your Data folder:

  • Prevent inheritance of permissions
  • Grant SYSTEM and Administrators Full Control
  • Grant all of your users the following permissions, specifying that they Apply to: This folder only:

    • Traverse Folder / Execute File
    • List Folder / Read Data
    • Read Attributes
    • Read Extended Attributes
    • Read Permissions

These permission allow all users Read access to the Data folder. While they can see the folder's contents, they cannot open any subfolder unless they're granted further permissions (below).

For each "Top-Level" Subfolder:

Grant the desired read/write group:

  • Modify permissions, specifying that they Apply To: Subfolder and files only
  • The following permissions, specifying that they Apply To: This folder only:
    • Traverse Folder / Execute File
    • List Folder / Read Data
    • Read Attributes
    • Read Extended Attributes
    • Create Files / Write Data
    • Create Folders / Append Data
    • Read Permissions

These permissions grant select users the traditional Modify permissions to the Subfolder, with the two exceptions that they CANNOT 1) Rename, or 2) Delete the subfolder.

For an added flair, enable Access Based Enumeration (if your share is on a Windows Server) and when users open the Data folder they'll only be able to see Subfolder(s) to which they've been granted further access.

  • Twisty, to the point (These Special permissions, specifying the Apply To: (This folder only)), when I click on show advanced permissions, I don't see this option. But as I tried to set with other shares, I did see it come up once. and it worked fine, but I don't see this option anymore to apply to other folders. Just the Electrical folder works fine as the option did show up. Is this option hidden or something? – Jess Feb 18 '17 at 3:26
  • You need to choose Advanced – Twisty Impersonator Feb 18 '17 at 4:21
  • This is the sequence I follow: Right-click on Electrical folder, Properties, Security tab, Advanced button, double-click Electricalgrp group from list, select from drop down-Applies to: Subfolders and files only, click on Modify, click on Show advanced permissions(this is where I don't see "This folder only"). Am I doing something wrong here? – Jess Feb 18 '17 at 5:12
  • >>>"select from drop down-Applies to: Subfolders and files only..."<<< This is where you have to choose "This Folder Only", NOT the special permission section! – NetwOrchestration Feb 18 '17 at 5:57
  • To configure what the permissions Apply To: Right-click folder > Properties > Security tab > Advanced > Change Permissions > Edit... > then change the Apply to: drop-down. – Twisty Impersonator Feb 18 '17 at 15:37
1

Your answer, lies in "Inherit Only" permissions, which only applies to subfolders and files, not the parent container itself. as described by SS64:

Inheritance

Inherited folder permissions are given as:

 OI - Object inherit    - This folder and files. (no inheritance to subfolders)
 CI - Container inherit - This folder and subfolders.
 IO - Inherit only      - The ACE does not apply to the current file/directory

These can also be combined as folllows:
 (OI)(CI)      This folder, subfolders, and files.
 (OI)(CI)(IO)  Subfolders and files only. <<<!!!
     (CI)(IO)  Subfolders only.
 (OI)    (IO)  Files only.

Run this script as an administrator, please note that if you modified permissions on individual subfolders, or 'Data' folder, it works best if you delete them and let the script create the folders:

@echo off

rem Define the 'Data' folder path, with/without quotation:
set DesFol="X:\Example Path\Data"
set DesFol=%DesFol:"=%

rem If groups are global (domain groups), set this value to domain BIOS name (e.g MYDOMAIN in MYDOMAIN\Electricalgrp), otherwise, leave it blank:
set Dom=

rem Creates or claims the access to the folder:
if exist "%DesFol%" (
 takeown /f "%DesFol%"
) else (
 md "%DesFol%"
)

rem Removes potential inheritance of "Everyone" access + makes sure Admins have full access to subfolders + makes :
icacls "%DesFol%" /inheritance:r /grant:r SYSTEM:(CI)(OI)F Administrators:(CI)(OI)F Users:R /q

rem Create 'Electrical' subfolder and inherit full access to "SUBFOLDERS AND FILES ONLY":
md "%DesFol%\Electrical"
icacls "%DesFol%\Electrical" /grant %Dom%\Electricalgrp:(X,GR,RC,RD,RA,REA,AD,WD) /q
icacls "%DesFol%\Electrical" /grant %Dom%\Electricalgrp:(CI)(OI)(IO)M /q

rem Create 'Plumbing' subfolder and inherit full access to "SUBFOLDERS AND FILES ONLY":
md "%DesFol%\Plumbing"
icacls "%DesFol%\Plumbing" /grant %Dom%\Plumbinggrp:(X,GR,RC,RD,RA,REA,AD,WD) /q
icacls "%DesFol%\Plumbing" /grant %Dom%\Plumbinggrp:(CI)(OI)(IO)M /q

rem Create 'Payroll' subfolder and inherit full access to "SUBFOLDERS AND FILES ONLY":
md "%DesFol%\Payroll"
icacls "%DesFol%\Payroll" /grant %Dom%\Payrollgrp:(X,GR,RC,RD,RA,REA,AD,WD) /q
icacls "%DesFol%\Payroll" /grant %Dom%\Payrollgrp:(CI)(OI)(IO)M /q

Update:

To be honest, this is now mostly the solution provided by Twisty, I just wrote the script. So he/she is the one who provided correct answer.

  • This script doesn't work... – Twisty Impersonator Feb 16 '17 at 22:51
  • Tried the script and I had some errors. I removed everything from the start to the end of the if statement. Just added the md command. Replaced all occurences of %DesFol% the absolute path and the script runs but I get errors pertaining to the (CI)(OI) and (IO). I'm on the file server, perhaps I need to load a module or something. – Jess Feb 17 '17 at 17:14
  • @Twisty You're right, I should have test it. – NetwOrchestration Feb 17 '17 at 18:28
  • @Jess I updated the script and it's tested. Now it works. – NetwOrchestration Feb 17 '17 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.