I need some help to accomplish what seems is not possible although the problem statement is simple. Can the experts in NTFS security help?
We are running Windows Server 2003 with NTFS. Clients are Windows XP Professional and Vista.
1. We want three levels of secure folders on one network share. say A,B,C. As seen from a client it with a drive mapped, it could look like T:\A\B\C\
2. At levels A,B and C users of our Domain Group ?Staff? must not be allowed to:
a. Create any files or directories
b. Delete any files or directories, INLCUDING subdirectories and ?subfiles?
c. Move any files or directories, INCLUDING subdirectories and ?subfiles?
3. At any directory lower than C, say D, all must be possible.
4. Our Domain Administrator or other designated user must be allowed to create the required secure directories.
5. This requirement must preferably be relative easy to implement.
Example:
Given:
T:\A\B\C\D1\A.txt
T:\A\B\C\D2\B.txt
T:\A\B\C\D3\
Scenarios for a user of the ?Staff? Group:
1. Creating a file or directory on T:\A\B\C must not be possible.
2. When trying to DELETE directory D1 nothing must happen, i.e. A.txt or D1 directory must not be deleted.
3. Trying to MOVE directory D1 to say T:\A\B\C\D3\ must do nothing, i.e. not partially or completely move A.txt or directory D1
4. Creating a new file or directory in D3 must be possible.
5. A.txt can be renamed or deleted
6. A.txt can be moved to T:\A\B\C\D3\
