Help need with folder permissions

[tookawhile]

I’m trying to set-up a share to allow me to do the following.
I have created a group called ‘tempworkersadmins’ – they need full control of the folder named ‘tempworkers’
I have created a group called ‘tempworkers’ - they need full control of the folder set-up for them, e.g ‘harry’ ‘sally’ etc.
Under the ‘tempworkers’ folder I have created a folder for each tempworker, so have the following:
tempworkers/harry
tempworkers/sally
etc, etc
I want each temp worker only to be able to access and see their folder; they can read/write etc only within their own area.
I have tried various ways but cannot get to work how I would like.
Tempworkers folder – with tempworkeradmins group with full control
Added ‘tempworkers’ group to tempworkers folder with read only, also tried read/write
Given sally/harry for permissions to their area, still cannot write to it though, the only way I’ve got it to work is to give the’tempworkers’ group read/write access at the top level.
I guess want I want to do would be a similar configuration you might have for ‘users’ storage area.

 

[NickFerrar]

Assuming you're sharing at the TEMPWORKERS folder level then give the tempworkersadmin and tempworkers groups full control (share permission).
For NTFS permissions give tempworkersadmin full control (I'm assuming inheritance is turned on as well as it should be by default). Then go into advanced security and give the tempworkers group the "list folder/read data" permission and apply onto "This folder only".
Then on each users sub-folder give them read/write/whatever on their own folder.

 

[tookawhile]

Well, I've tried that and I still have a problem. A tempworker who is listed in the tempworkers group cannot even see the contents of the TEMPWORKERS folder.

Inheritance is turned on, TEMPWORKERS folder has been set as follows:

Sharing - tempworkersadmin + tempworkers + full control + read + change

Security - tempworkersadmin + full control | tempworkers + special permissions (list folders read data)

For the folder under TEMPWORKERS i.e 'Sally' it set as follows:

Sharing - n/a

Security - tempworkersadmin + full control (inherited)| sally + full control

 

[kmcferrin]

Do they really need full control? In most cases users do not, they only need read/write permissions at most. Full control also allows you to change ownership of the files, etc, which are things that should rarely occur.

 

[tookawhile]

Good point, the 'user' only need read/write, the tempworkersadmin do though.

 

[tookawhile]

Think I've done it - had to turn off inheritance at the top level.