File Permissions Assistance

[dwessell]

Hi all... I'm still working my brain through AD and file permissions..

I have a User Group, then a Sales Group and a Technical Group which are both members of the User Group.

I have a Shared Folder, and underneath that a Sales Folder and a Technical Folder.

How can I setup the folder permissions so that Sales folks can go into the sales folder, but not the Technical Folders, and vice versa?

Should I give the User Group full permissions on the Shared Folder, then deny specific groups in the folders below that?


Thanks
David

 

[WhoKilledKenny]

Here is what I would do....

First I would try an aviod nesting groups within groups, even though you can it can get messy

SharedFolder
|
|-Sales
|-Technical

On the share permission of the SharedFolder make it Everyone/Full. On the NTFS Permission (security Tab)make it Domain Admins/Full, Everyone/Read.
Block inheritance on the Sales and Technical folder so that the everyone group doesn't have access and make the NTFS (Security Tab) permissions as such:
Sales - DomainAdmins/Full, Sales/Change
Technical - DomainAdmins/Full, Technical/Change.

You can do variations on this like having two groups per folder for different access. Example SalesGroupChange/Change and SalesGroupRead/Read. This was you would just place the user in one of these groups depending on the access they require.