Complex file permissions issues

Question

I'm working on trying to setup file permissions on a share for a client and have been unable to figure out a way to do what they have asked for. They have a predefined structure of directories inside each client directory and have shared the parent folder
that holds all the individual client directories. In each client directory it has the same structure as the other clients' and is supposed to have varying permissions regarding files and folders throughout, however, the initial structure of directories should
never be allowed to be changed by the client accounts in the group granted permission to their structure.
Throughout the structure those in that client group in AD should have read and execute everywhere, which is easy to set and I've had no issues with. In some of the subdirectories they should have modify/delete for it's contents, sometimes restricting this
to just files vs files and directories. If the directory that should allow that is not followed by any further directories defined by the structure I can configure that as well. It's when a directory is supposed to allow the client modify/delete on it's subdirectories
and files BUT it has a child that the client should NOT have modify/delete on because it's part of the pre-defined structure that I run into a problem.
Example folder structure:
Client_Name -> Data -> DataSub
They have read, transverse, list, execute on Client_Name and can't change the Data directory itself. Then they need to be able to create, modify and delete files and directories inside Data BUT they can't be allowed to do that to the prexisting DataSub directory.
They also must be able to create, modify, and delete files and directories inside DataSub.
I've tried using a deny rule applying to "This folder only" on DataSub and selecting (create files/write data, create folders/append data, write attributes, write extended attributes, delete subfolders and files, and delete) while having an allow
rule for the same + read applying to "This folder, subfolders, and files" but DataSub is still modifiable and then nothing inside it is.
I've also tried allowing (traverse folder/execute file, list folder/read data, read attributes, read extended attributes, read permissions) on DataSub applying to "This folder only" and then another allow rule applying to "Subfolders and files
only" allowing (create files/write data, create folders/append data, write attributes, write extended attributes, delete subfolders and files, and delete). DataSub is still modifiable and nothing inside it is again.
I can't figure out how to do this and I'm not 100% sure it's even possible. If anyone could provide any insight or help I'd greatly appreciate it.

Answer 1

Hi, If I see it correctly, that's how I would do it;
- I would desactivate inheritance on all 3 folders & remove all security.
- I would create 3 groups to apply to each folder.
- I would make the group member of each folder with the general read flag.
- I would click in the advanced security to make them able to modify, erase for
file and subfolder only
I would not use deny as it make the ACL harder to read.
Regards, Philippe
Don't forget to mark as answer or vote as helpful to help identify good information. ( linkedin endorsement never hurt too :o) )
Answer an interesting question ? Create a
wiki article about it!