Access to a sub-folder only

[Koldov]

This is probably a very simple one, but I've got a lot on at the moment so I'm a bit distracted and don't want to make a mistake...

 

We have a student teacher who has just started and they need to be given access to a folder within our main staff shared folder, but with no access to the main folder (or any others) - just to folder 1.3.

 

Folder 1$ > (root shared with - administrators, staff - this folder, sub-folders and files - advanced sharing - everyone - full control)

 

----- Folder 1.1

----- Folder 1.2 > All other folders inheriting.

----- Folder 1.3

----- Folder 1.4

 

I'm probably over thinking it, but I don't want to mess up shares or permissions for anyone else.

 

Also, I have given them a log-in but it is under the group in AD (with the other staff) that maps and has full access to the main shared folder (so all the other relevant GPOs apply) and I'm not sure how to accomplish it in the easiest way.

 

Most Googling seems to suggest things like disabling inheritance (replace all child object permissions and convert to explicit permissions) then create a seperate share for that folder and then map it for that user.

 

To limit their access to the other folders would I then have to make a seperate OU for the user and apply all relevant GPOs, or create a seperate security group for them only, or something else a little less complicated?

[cw222]

This might be the wrong way to do it - but wouldn't this work?

As deny takes precedence over allow (especially with directly applied permissions), could you :

1. explicitly deny this users access to 1$
   
2. disable inheritance on 1.3
   
3. give this user and all other staff permissions to 1.3?
   

 

(edit formatting)

Edited January 29, 2020 by cw222

[Dave_G]

I'd just give them explicit permissions to the folder itself, then send them a direct link to the folder to use.

 

I know it's not as elegant as setting permissions so that they can traverse through from the root folder, but you'll end up tying yourself in knots when another student teacher needs access to Folder 1.4 or other folders buried deeper.

[p858snake]

Also have a look at Access-based enumeration

[Duke5A]

I'd just give them explicit permissions to the folder itself, then send them a direct link to the folder to use.

 

I know it's not as elegant as setting permissions so that they can traverse through from the root folder, but you'll end up tying yourself in knots when another student teacher needs access to Folder 1.4 or other folders buried deeper.

 

Take this one step further and map a drive to the full path of said folder. Make it a persistent connection for the user. If they travel between computers then you could use GPP with item level targeting.