Good day. I have a file server (Windows 2012 R2) that houses a total of three network shares. I have been trying to figure out permissions for my domain users for some time and can't seem to get them quick right without giving too much. Here is the scenario using test folders on drive F.

  1. In the drive there are two folders (Test1 and Test2)
  2. Test1 should be accessible by domain admins and group1
  3. Test1_1 (subfolder to Test1) should be accessible by domain admins, group1, and group2
  4. Test2 (is not shared and should only be visible to domain admins)
  5. Test2_2 (subfolder of Test2) by domain admins and group3

group1 and group2 would get modify permissions to their respective shares. group3 would get modify permissions minus ability to delete anything.

Let me know thoughts on how to restrict so that the root drive (F) and networks shares have the correct permissions for access without granting too much.


Give Domain Admins the appropriate permissions on the Test1 and Test2 folders.

Then give the groups that need access to the subfolders only the "Traverse Directory" on either Test1 or Test2 depending on which subfolders you would like them to have access to. You can consider the "List Folders" permission also, depending on if you're mapping a drive or they are browsing to find the shared folder. Both of those permissions are found under "Show Advanced Permissions". Then give those non-domain admin groups the appropriate permissions on the child folders they require access to.

You will need to share Test2 or the domain admins will not be able to access it remotely. You can create a hidden share by putting a $ on the end of the share name (Test2$). It still won't be visible to the domain admins if they are looking at file shares on the server but it will make it accessible to them. You can then create a second share for Test2_2 that everyone can see. The assigned permissions will keep anyone but domain admins and group3 from accessing it.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.