Folder permissions

[Patrick]

Good morning,

 

We have a new drive share with various resources for staff. We have a folder called prayers, now we want to have one member of staff's account have read write privileges so she can add prayers, change them etc.. But school want all other members off staff to be able to read it only. All staff accounts fall under the same group in AD, so denying the staff group denies all the staff including the specified staff account as deny rule takes precedence.

 

Is there anything i can do or does it mean restructuring AD? Any ideas would be great.

[Davit2005]

To start with I'd always recommend using groups when working with shared access drives so when someone leaves or needs access it doesn't leave SSID's everywhere and is just a matter of adding the member of staff to the group.

 

All you need to do is change the permissions on the prayers folder, disable inheritance but make sure you copy the existing permissions when prompted so as not to lock your self out, remove staff and re-add as readonly for staff and then give the group created modify rights.

 

Our permissions are structured slightly diferently but this should work fo you. Suggest you use the Advanced sharing option though to change permissions.

Edited January 28, 2016 by Davit2005

[Patrick]

Yeah it looks like i'll need to do with AD restructuring. It's needed anyway as the school has rapidly out grown it's current infrastructure. Cheers mate.

[clareq]

You can use security groups to set permissions - you don't need to restructure AD. Just create two security groups, edit_prayers and noedit_prayers. Put each staff member into the appropriate group. On the folder go to Security, advanced. Disable inheritance, copying the existing structure, then allow noedit_prayers read access, and edit_prayers modify access. Remove the existing staff group. Users can be members of many groups at once.

[Patrick]

That's brill. Thanks!