On our file server, we have a directory, let’s say S:\, that is shared out as \\server\share. This share is mounted (mapped) by our application server, as, say, M:\ = \\server\share.

We use a particular Windows user, batchUser, to run batch processes on as application server. These processes create\modify\etc. files in this directory (or its subdirectories), and so this user ID has the appropriate write permissions.

On the server is a directory tree containing, among other thing, the directories S:\rootDir1\subDir and S:\rootDir2. Some of our processes write to this directory. A couple of our processes need to read from this directory, but they must be prevented at all costs from writing to this directory. Furthermore, these read-only processes must also run as the same user ID.

For various other reasons, the read-only processes access this subDir via a junction that is set up on the file server. That is, on the file server, there is a junction S:\rootDir2\subDir => S:\rootDir1\subDir. Thus, on our application server, the applications see two directories, M:\rootDir1\subDir and M:\rootDir2\subDir.

We need to ensure that the read-only processes do not modify or write to the M:\rootDir2\subdir directory in any manner. Is there any way to make the junction on the file server a "read-only" junction?

One issue with this is that we need to preserve the directory tree structure for the read-only processes. That is, the read-only processes must see the directory tree M:\rootDir2 as we have it and be able to write to all other directories within this tree except for the M:\rootDir2\subdir junction.

Lastly, this must be done with junctions (that are processed on the file server side) and not symlinks that are processed on the app server side. (This is a requirement because of other issues, such as accessing the the directories via different interface cards, i.e. different networks.)

  • No, there is no way to do this within all of the constraints you have outlined. Feb 24, 2015 at 21:40
  • ... actually, you could do it with a file system filter that implemented a custom version of a junction point. There might be third-party products that already support the functionality you want, though they're liable to be expensive. Feb 24, 2015 at 21:57

1 Answer 1


Dokan has an example application called "mirror" which you could possibly use.

It has a flag, "/w", which allows to mount a directory as read-only.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.