Shared drive structure

[gshaw]

I'm building our replacement VM file server at the moment and having a think about a better permissions system than what we have now, would be interested to see some input on the idea I've had based around these (rather good) articles...

 

The Golden Rules of Permissions Administration - NetworkAdminKB.com

Axioms of Permissions Administration - NetworkAdminKB.com

 

The idea is to have each area's files as a secured folder under a common root (rather than 1 share per area as we've had in the past) so thinking along the lines of...

 

Sharedfolder (shared)

 

Security permissions...

SYSTEM, local administrators, administrators = Full Control (apply to all subfolders \ files)
Authenticated Users (or for more paranoia our All Staff group) = Read (this folder only)

 

Logic being they can Read to see the list of folders (or not if I turn ABE on ) but not access them unless explicit permissions are granted... which leads to the next bit...

 

Under this top root I have various folders, let's call them Red, Green and Blue. Usually I'd just think to turn off inheritance, copy the common permissions (for SYSTEM etc) then assign a group called Red with Full Control. According to that article I may be better off going for an additional tier of folder resource groups and adding the User groups to that instead. Don't think we have a need for Read Only folder access but seems more flexible in the future.

 

Then for the migration I'm aiming to use Robocopy to shift the files from the old server, move them into place (some folders merging so will need a bit of manual tidying) then replacing old permissions on the files with those of the new container folder.

 

Any input on what works well for you as always appreciated

 

Edit: from testing I've found that users can delete the subfolders if they have Modify rights on it, which would be expected (permission set to this folder, subfolders and files). If I change that to subfolders and files only I lose access to the subfolder which means I can't in there to view any files... not much use either!

 

Solution seems to be setting an additional permission to Deny Delete, Change Atrributes etc which leaves me with what I want...

 

- everyone can view the listing of subfolders under the root

- certain groups can then access the subfolders assigned via group membership (but not modify the subfolder itself)

- those certain groups can create \ delete files and folders as much as they like

 

Not sure if there's a more elegant way but doesn't seem to be as the explicit Allow on the subfolder overrides any inherited Deny from above... gotta love permissions

Edited December 1, 2011 by gshaw