2

I have a group(GroupA) that needs access to a sub-folder(FolderA2) of a sub-folder(FolderA1) of share FolderA.

Shared folder FolderA and sub-folders:

 FolderA
  |
  +--FolderA1
     |
     +--FolderA2

This is what I am trying to accomplish(Steps 1 and 2 working fine):

  1. FolderA share restricted to Read only, I don't want users to be able to create folders or files in the root of the FolderA share.

  2. GroupA should be able to create,delete, and modify folders and files in FolderA1 folder but not be able to delete the FolderA1 folder. I have this working fine up to this point.

  3. FolderA2 must only be accessible to a couple of users that also belong to GroupA as this folder contains sensitive information that only two users should be authorized to access.

Since I have everything working fine up to step 2 or sub-folder FolderA1, I will only describe what I have done for FolderA2.

To address FoderA2 issue, I have done the following:

  1. Created GroupB
  2. Added users to GroupB that need access to FolderA2
  3. Disabled inheritance to FolderA2.
  4. Removed GroupA access
  5. Added GroupB access to FolderA2 security and Applied to "This folder only" and selected the following under advanced permissions:

    • Traverse folder/execute file
    • List folder/read data
    • Read attributes
    • Read extended attributes
    • Create files/write data
    • Create folders/append data
    • Write attributes
    • Write extended attributes
    • Delete subfolders and files
    • Read permissions

      1. Added another GroupB access to FolderA2 security and Applied to "Subfolders and files only" and selected the following under advanced permissions:
    • Traverse folder/execute file

    • List folder/read data
    • Read attributes
    • Read extended attributes
    • Create files/write data
    • Create folders/append data
    • Write attributes
    • Write extended attributes
    • Delete subfolders and files
    • Delete
    • Read permissions

After applying this access rights, I tested users that belong to GroupA and they are indeed not able to access FolderA2 which is good. Now I try users that belong to GroupB and they can access FolderA2 as intended but they are also able to delete FolderA2 and that is NO GOOD. They are not supposed to be able to delete that folder. How do i get around this?

NOTE: Just so you know, since the users that need access to FolderA2 are already members of a group that has access to the share FolderA and sub-folder FolderA1, I did not add GroupB access to FolderA share or FolderA1 sub-folder. I just added GroupB access to FolderA2.

======The following are the images that show the settings of the folders======

FolderA Share Permission

FolderA Share Permission:

FolderA Permission Entry:

FolderA Permission Entry:

Advanced Security Settings FolderA1:

enter image description here

FolderA1 Permission Entry 1:

FolderA1 Permission Entry 1

FolderA1 Permission Entry 2:

FolderA1 Permission Entry

FolderA2 Advanced Security Settings:

enter image description here

Permission Entry for FolderA2:

Permission Entry 1 for FolderA2

Permission Entry 2 for FolderA2:

enter image description here

When testing user access that has access to FolderA2, access is denied:

enter image description here

If I add "List Folders" a 3rd permission applied to "This folder only", I can access the folder. I can delete files and folders but I can't create files or folders and I am able to delete FolderA2.

  • @walmart Here's the update for the folder permissions. – Jess Feb 22 '17 at 17:15
1

They are also able to delete FolderA2 and that is NO GOOD. They are not supposed to be able to delete that folder. How do i get around this?

You can run the applicable icacls commands to the specific and explicit folder you wish to lock down, and DENY the DELETE permission at that folder level to GroupB. So once you get GroupB setup with the access you need it as you explain, simply run this command and all should be set as you need it.

1. Disable Inheritance

Right-click the FolderA2, select Properties, Security tab, Advanced, Disable Inheritance, select the Convert inherited permissions into explicit permissions on this object option, and then click Apply > OK.

enter image description here

Back in the Security tab of FolderA2 properties, select the Edit button. Now select and remove all groups and accounts listed but leave Domain Admins, System, and Creator Owner, Apply, OK.

Now run the below iCALCS Command against the FolderA2 folder just as shown, then click Apply > OK.

2. iCALCS Command

Be sure to look over Disable Inheritance and complete that before you run this command

icacls "\\server\FolderA\FolderA1\FolderA2" /deny "GroupB":(DE)

BONUS NOTE: The above also prevents the infamous inadvertent drag and drop of the folder too.

WARNING: If in a domain environment, please allow up to one hour for security changes become effective. Once security changes do become effective, user accounts may need to logoff and then back onto a computer\system before they'll get the newly setup NTFS ACL security permissions.


Equivalent GUI Method

3. Explicit Deny

Right click on FolderA2, select Properties, go to the Security tab, and select the Advanced button. From the Advanced Security window, select the Add button. Then from the Permissions Entry window, click on the Select a principal option, and type in GroupB and press Enter. From here you will select the Deny permission in the Type field, and select the This folder only in the Applies To field. Lastly, just ensure that only the Delete option is selected in the Advanced Permissions window, and press Apply > OK.

enter image description here

4. Explicit Allow

Be sure that any MODIFY permissions you grant or allow GroupB to have to FolderA2 explicitly that you're sure you apply it to Subfolders and files only otherwise the GroupB may get the ability to delete the FolderA2 from this configuration explicitly from what I tested.

enter image description here


Further Resources

  • iCACLS

    • DE - Delete

    • /deny user:permission

      Explicitly deny the specified user access rights.

      This will also remove any explicit grant of the

      same permissions to the same user.

  • Added the deny as you instructed in the GUI method and it does not work. It still allows the GroupB users to delete FolderA2. I tried the ICACLS cmdlet and I get a message: DE : The term 'DE' is not recognized as the name of a cmdlet,..... – Jess Feb 20 '17 at 5:33
  • Here is a snapshot of the permissions as seen from a user that is a member of GroupB logged on to windows 7 Enterprise link. – Jess Feb 20 '17 at 20:02
  • This snapshot(FolderA2 Permissions) shows the permission entries for FolderA2 – Jess Feb 20 '17 at 20:15
  • Walmart - User(member or GroupA and GroupB) effective permission snapshot User effective permissions – Jess Feb 20 '17 at 20:23
  • Walmart - This snapshot(GroupB) shows the effective permissions of GroupB. – Jess Feb 20 '17 at 20:28
1

Updated server. Same issues.

Users and Groups:

GroupA

UserA

GroupB

UserAB

Thanks for all the help Walmart. It seems that the problem was at FolderA1. Here's the pictures of security rights of the folders:

FolderA Share Permissions:

enter image description here

FolderA Advanced Security Settings:

enter image description here

FolderA Permission Entries:

enter image description here

FolderA1 Advanced Security Settings:

enter image description here

FolderA1 Permission Entries:

Entry 1:

enter image description here

Entry 2:

enter image description here

FolderA2 Advanced Security Settings:

enter image description here

FolderA2 Permission Entries:

Entry 1:

enter image description here

Entry 2:

enter image description here

This works great. Locks out unauthorized users from FolderA2.

I am still puzzled with the effective rights for GroupB on FolderA2, see below:

GroupB Effective permissions on FoderA2:

enter image description here

UserAB Effective permission on FolderA2:

enter image description here

Again, thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.