Server 2012 Sharing Configuration.

Question

We recently just deployed Server 2012 Domain. It has 6 Shares that everyone has access to. I want to create a group that is only read only. I have a lot of dwg,excel I don't want this group to be able to modify just view? What is the easiest way to do this
without doing thousands of files manually? I have created a group called read only and put users in the group and applied file permissions to the group but still no luck? Any ideas?

Answer 1

If you have full for domain users, or authenticated users you would need to remove those otherwise users will get full access based on those groups and the new read only group isn't really doing anything.
1) go to each folder and stop inheriting permissions, it should ask if you want to copy current say yes.
2) now you have folders with no inheriting permissions add the users you want to have full access to a group and assign it to the folders and subfolders.
3) add the group you want to have read only to folder and sub folders.
4) remove generic groups from the folder like authenticated users, domain users, or everyone if there.
5) if you wanted you could create a group for full access and assign only the read only to authenticated users instead of creating two groups. this way all authenticated users would have read only by default only full access users would need to be added
to group, the read only because they are in authenticated users would essentially be ignored.
security is inclusive with all group memberships and deny will override any allow so be carful with denying rights.