Windows Forum

Ask something
Discussion Locked

Server 2003 Q

0 helpful
2 replies

by tim.doyle

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Anyone know a way to setup a series of folders on a 2003 server so that users who don't have rights to a folder can't see it even though they map a drive to its parent folder?

User A has rights to folder A, B has rights to B and neither one has rights to the other, but both folders are contained under the same top level folder. User C needs to have access to both A and B so the obvious solution is to have everyone map the same drive letter to the parent folder and use group rights to restrict access where needed. The only problem is that user A can see folder B and B can see A...they can't open it, but they can see it. To make this picture complete I should mention that I have a total of about 180 users with varying access requirements, so I cna't just use a different drive mapping for each departmental folder.

This is a major problem for me and I need to solve it. I'm doing the prep work for transferring my files from a Netware server to a 2k3 server and can't really think of another solution to this issue.

2 replies

by cptomlly

How about using a combination of share and NTFS permissions. Instead of creating 1 share, create 3. That would be one for the parent folder, one for each child folder. For example, group A maps to a share that points directly to folder A. Likewise group B maps to share of folder B. Group C, who has access to the parent and all subs should map to a share pointed at the parent. In this manner you can control visibility and access by only giving share permissions to the group necessary. Only give access to the parent share to Group C. If the more restricted groups cannot access the parent share, they don't know the other folders exist. Likewise, to simplify YOUR life, don't give Group C access to the lower level shares, make them access through the parent. The NTFS permissions are universal regardless of which share point they access from.

I'm not sure from your description if you are looking to have 180 sub-folders in this root folder (one for each user?). This would make my solution quite impractial due to the volume of shares you would have to create. You beg the question of "Why does it matter if they can see the folder, if they cannot access the contents?"

Hope this helps you out. I can tell you from experience that you cannot spend too much time setting up your file server NTFS/share permissions. A lack of planning now will result in a NIGHTMARE folder/permissions structure to deal with later.

If you'd like more detailed description, post back with details or msg me through peer directory.

by tim.doyle

I think this is the right track and will be doing some experimentation along these lines.

The full story is I have about 180 users and 4 dozen folders. Many users only need to access their specific department and the full public folder so I could use two mapping in place of the one I have now for them. The problem comes when I have users whose responsibilities span multiple (but not all) departments. So for example the Technology department will need to be able to see everything, so I would map to the root data folder that contains everything, but one of my executives will need to see the Accounting folder as well as the executive folder, Marketing and Banch Administration, but must not under any circumstances see the Sales and HR folders.

It matters in a huge way that people not see folders that they couldn't see before. Users have enough trouble remembering where some of their files are without my adding another 35 folders to their list that they have to sort through before they can find their stuff. Its also an audit issue that people not see stuff they shouldn't see...even if they can't access the contents.

I'm thinking that I'll create the 4 dozen shares and then explicitly allow the groups rights to both the share and the folder security. Hopefully thise will remove folders from their view in Explorer.

This discussion is closed to new replies.