Shared Folders for Departments

[raycclark]

I am new to SBS, so sorry if this is a very basic question. I would like to create a shared folder for each department (i.e. Accounting, Sales, etc.) that is only accessible to each person in that department. I created a security group and added members to the group. I created a share to the folder (\\server\dept). I set the security exactly like the users shared folders. Even though I am not in the Accounting security group, I can access the folder (\\server\dept\accounting). I believe the domain users group is granting me access, but when I remove domain users and add the security group (accounting), the users in the security group cannot access the folder. Any help would be greatly appreciated.

 

[LWComputingMVP]

what happens if you set the permissions so that you have only Accounting, Domain ADMINS, and the system account listed?

-Lee

Those who ask why, learn

http://www.lwcomputing.com

 

[raycclark]

With only Accounting, Domain Admins, and System, the user in Accounting cannot access the folder. Maybe I do not have the security group for Accounting setup correctly.

 

[noveyron]

Were you using a domain admin/administrator account whilst testing the security?

 

[mofusjtf]

Try giving Domain Users Modify permission then adding additional permissions for each department and deny access to those groups that do not need access. The most strict permission will override the domain users permission.

For Example on your accounting share you would have domain users with modify (or full control) and then additional permissions for the specific groups you want to deny access to this share.

 

[raycclark]

In testing the security, I used a user account (non admin). I had rather grant permission to the specific group, instead of denying permissions to the groups that I want to deny access.

 

[mofusjtf]

Give all users modify access to the Root folder. Then on the department folder make sure you set it NOT to inherit from the parent folder and then assign specific permissions for only those users you want to have access to the specific folder.

 

[noveyron]

When you did the share, did you put the leave the share permissions as default, and then add the permission for the security group on the security tab?

What happens if you share at server\dept\accounts level rather than server\dept, and then assign permissions as above?

(Test on a new set of test folders rather than the ones you are working on)

 

[raycclark]

Thanks to everyone for your help. When I created the new security group and added users to the group, I tested access with a user that was already logged in. The user didn't join the security group until they logged out and back in. Now everything works.

Thanks, again.

 

[ShackDaddy]

Yes, per-group security tokens are attached to the user at logon, so any new groups you add them to will not affect their tokens until you log out, and log back in.

Dave Shackelford
Shackelford Consulting