How to make folders user doesn't have access to not show up in folder listing?

[Cerulean]

Greetings,

Before our hypervisor kicked the bucket taking down the file server VM with it, this is the way it worked:

User would go to G:\ drive (network drive map to shared folder on file server VM).
Inside this drive was a handful of folders, each titled after the name of an overseas division.
Each folder had NTFS permissions "Domain Admins" (Full Control) and "<name of overseas divison>" (Full Control). If the user did not have membership to all overseas divison groups, only the ones the user had access to would show up in the list of folders the user could open. This was nice and awesome because then the user would only see what they have access to.

Now the only permissions that changed after we finally got our file server back on the ground was the root folder NTFS & Shared permissions (a couple other things as well, but let's start from the root/simplest level).

If I recall correctly, Shared permissions had Domain Admins with Full Control, and either Authenticated Users or Domain Users with either Full Control or just Change+Read. The NTFS permissions had Domain Admins with Full Control, and either Authenticated Users or Domain Users with some read-only ability (I do not remember which checkboxes were checkmarked for the Permission Entry window, but nothing like being able to create/write/change/take ownership was checkmarked for sure).

I should have documented this and I was going to do it but I was too late and should have done it when I set it up.

Right now, users see all folders. If they try to open a folder they don't have access to, it will simply give them a pop-up message saying they don't have access to it.

EDIT: The first couple or few levels of folders do not inherit permissions. The folder structure is like this:

\\server-fs1.company.local\g\
\\server-fs1.company.local\g\Shared
\\server-fs1.company.local\g\DivisionA
\\server-fs1.company.local\g\DivisionA\Shared
\\server-fs1.company.local\g\\server1\g\DivisionA\Department1
\\server-fs1.company.local\g\DivisionA\Department2
\\server-fs1.company.local\g\DivisionA\Department3
\\server-fs1.company.local\g\DivisionB
\\server-fs1.company.local\g\DivisionB\Shared
\\server-fs1.company.local\g\DivisionB\Department1
\\server-fs1.company.local\g\DivisionB\Department2
\\server-fs1.company.local\g\DivisionB\Department3
\\server-fs1.company.local\g\DivisionC
\\server-fs1.company.local\g\DivisionC\Shared
\\server-fs1.company.local\g\DivisionC\Department1
\\server-fs1.company.local\g\DivisionC\Department2
\\server-fs1.company.local\g\DivisionC\Department3

'Shared' is a folder accessible by all within that level. For example, '\Shared' is available to the entire company regardless of what division you are part of; '\DivisionA\Shared' is only available to everyone at DivisionA.

EDIT2: Right now, this is how permissions are set

\
Shared permissions: Domain Admins (Full Control), Everyone (Change+Read), Domain Admins (Change+Read)
NTFS permissions: Authenticated Users (Traverse folder / execute file, List folder / read data, Read attributes, Read extended attributes, Read permissions; This folder, subfolders, and files), SYSTEM (Full control [every checkbox]; This folder, subfolders, and files)

\DivisionA
NTFS permissions: DivisionA (Traverse folder / execute file, List folder / read data, Read attributes, Read extended attributes, Read permissions; This folder, subfolders, and files), Domain Admins (Full control [every checkbox]; This folder, subfolders, and files), Authenticated Users (same as DivisionA), SYSTEM (same as Domain Admins), local Administrator (same as Domain Admins)

 

[thrash408]

To hide it from view, under share properties put a $ at the end of the share. For instance, the share path i put is \\servername\DivisionA$\

That will hide it from anyone, they would have to know to put the $ at the end of the share.

If you don't want them seeing eachothers department, you will need to map their drive to the department rather then just the the "shared" folder at the top.

 

[Deleted member 12106]

You can use the net use command to map the share for users and add this to the log-in script. If you are using active directory you can make a login script for each department and apply it, or, you could map all directories as seen below and then use permissions to manage who can and cannot access the directories.

net use z: \\server1\department1

Curious why they should not see the folder? If access is not granted, they cannot get in there.

I also do not see domain users or other user groups added to any of those groups, or, groups broken down. For example, you could create a group called "department1" and add those users to that group. Then, apply that group read/write/modify. Create next group, and so on. Because those users on "department1" are not in "department2" group, they cannot access "department2". They can see the folder but cannot traverse that directory or sub-directories.

 

[Cerulean]

Apologies -- there is a misunderstanding.

\ = \\server1\g\
\DivisionA = \\server1\g\DivisionA

 

[Mackintire]

If you take Authenticated users and domain users out of share permissions that should also remove it from their view. Instead define groups like "Dept A Visitors" "Dept B Visitors" and added the users to those new security groups. Then place those newly created security groups in the share permissions.

That will allow only people in the "Dept X Viewers" to see that department.

 

[D-EJ915]

http://blogs.technet.com/b/hugofe/a...ss-based-enumeration-abe.aspx?Redirected=true

 

[Eickst]

http://blogs.technet.com/b/hugofe/a...ss-based-enumeration-abe.aspx?Redirected=true

This^

We use ABE on a lot of file shares, really cleans them up

Also, I want to point out that you shouldn't even mess with share permissions. Just set all permissions on the NTFS and leave the share permissions set to everyone-full control. You will have less headaches, and they will get assigned the most restrictive access between the two so it doesn't matter what its set to anyway. You can do much much more with NTFS permissions, inheritance, propagation, etc.