We are running Windows Server 2012 as a file server. How can I allow traversing of folders but not listing of any files within the folders?

I have attempted to restrict a group (FolderTravers) to have only "list folder / read data" under Advanced Permissions and only applying it to this folder and subfolders, but this still allows the listing of files that are also contained within the folders. They are unable to open – but they are still listed.

  • 1
    You can't. If a user has read permission on a folder they can view the contents of the folder. Its simply that simple This is true on Unix and Linux systems as well. – Ramhound Aug 28 '13 at 12:00

Look at the GPO setting "Bypass Traverse Checking". it allows you to navigate the path to a item you have permission to access, even if you don't have permission to each of the folders on the path.



This IS possible.

Do it by disabling inherited permissions on the sub-folders.

So assuming you want "Domain Users" to list folders, but not contents:

  • Set the parent folder to "List folder contents" for Domain Users
  • Then on each sub-folder, click Properties...Security...Advanced...Change Permissions...Disable inheritance.
  • Select "Convert inherited permissions into explicit permissions on this object."
  • Then for Domain Users, remove the "List folder contents" ability for that folder. Repeat for each sub-folder.

The obvious downside is that now you can't have permissions from the parent be inherited down the folder structure.

Security warning: If you create a new folder in the primary directory (the one with "List folder contents" permissions), make sure to do the above steps or else users will be able (by default) to see the folder contents.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.