Setting SharePoint folder permissions

Our school has just got SharePoint 2013, and I have been tasked with setting up a folder structure for the Teachers.
What they want is a Department Folder in the Root, and inside the Department Folder the Facility Folder, and inside that the Subject Folder, and lastly a private Teacher Folder for storing and preparing work.
EG:
Department/Science/Biology/MGreen
Department/Languages/French/RSmith
Department/Languages/Latin/TJones
I have setup the directory structure already, my question is how do make the Teacher Folder Private, so only they can view files inside?
Many thanks

Hi,
According to your description, my understanding is that you want to make the Teacher Folder with unique permissions so that only the specific teacher has permissions to it.
The following are the steps to set up unique permissions:
Navigate to the subfolder you want to configure with unique permissions.
On that subfolder, select Manage Permissions from the drop-list under that subfolder.
Under Permissions Tools, click: Stop Inheriting Permissions.
A dialog box that says, "You are about to create unique permissions for this folder. Changes made to the parent folder will no longer affect this folder." Click OK.
Then delete all SharePoint security groups. After that, assign permissions to the specific teacher.
Best Regards,
Wendy
Wendy Li
TechNet Community Support

Similar Messages

Unable to set Public Folder Permissions

I have created a Public Folder Mailbox and Public Folder. When I go to set permissions via the EAC, the "User" field is grayed out...when I Browse for a user I can search and select a user, but that user is not carried over to the User field where
you would set permissions. I am unable to see ANYYONE with permissions via the EAC. However, when I access my Public Folders in Outlook 2013, I and a co-worker both have "Author" level permissions.
I am an Administrator on the system and have added myself to the Public Folders role and anything else that looked even remotely related :-o
Thanks for the help!
-Nick

Hi,
We can try settings the permission on the specific folders by using the exFolders tool:
https://gallery.technet.microsoft.com/office/Exchange-2010-SP1-ExFolders-e6bfd405
Thanks,
Simon Wu
TechNet Community Support

Powershell Setting Share Folder Permissions

I have a script that create a shared folder and I am trying to set permissions. Here is what I have so far:
$serverName = "myfileserver"
$folderName = "d:\Personal"
$shareName = $newSAM+"$"
$fullName = "\\$serverName\"+$folderName.Replace(":", "$")+"\$newSAM"
# Creating the Directory
$finalResult = New-Item $fullName -type directory
$trustee = ([wmiclass]"Win32_trustee").psbase.CreateInstance()
$trustee.Domain = "domain.com"
$trustee.Name = $newSAM
$ace = ([wmiclass]"Win32_ACE").psbase.CreateInstance()
$ace.AccessMask = 2032127
$ace.AceFlags = 3
$ace.AceType = 0
$ace.Trustee = $trustee
$trustee2 = ([wmiclass]"Win32_trustee").psbase.CreateInstance()
$trustee2.Domain = "domain.com"
$trustee2.Name = "administrator"
$ace2 = ([wmiclass]"Win32_ACE").psbase.CreateInstance()
$ace2.AccessMask = 2032127
$ace2.AceFlags = 3
$ace2.AceType = 0
$ace2.Trustee = $trustee2
$trustee3 = ([wmiclass]"Win32_trustee").psbase.CreateInstance()
$trustee3.Domain = $serverName
$trustee3.Name = "administrator"
$ace3 = ([wmiclass]"Win32_ACE").psbase.CreateInstance()
$ace3.AccessMask = 2032127
$ace3.AceFlags = 3
$ace3.AceType = 0
$ace3.Trustee = $trustee3
$sd = ([wmiclass]"Win32_SecurityDescriptor").psbase.CreateInstance()
$sd.ControlFlags = 4
$sd.DACL = $ace, $ace2, $ace3
$sd.group = $trustee3
$sd.owner = $trustee3
# Creating the Folder Share
$finalResult = Invoke-WmiMethod -Class win32_share -name Create -ArgumentList @($sd,"",4294967295,$shareName,"","$folderName\$newSAM",0) -computername $serverName
The folder is created correctly but I am getting this error when setting permissions:
Exception setting "DACL": "Unable to cast object of type 'System.Management.Automation.PSObject' to type 'System.Manage
ment.ManagementBaseObject'."

I am testing it against a remote 2003 R2 SP2 server...
I have upgraded to Powershell v3 in my frustation (although I would rather have worked with the default like our helpdesk folks who will be running this - now we have to install this on all their machines)... Anyway...
I do not get any more errors when I run it, but it still does not add and share permissions... All it had is 'Everyone' as the sole group in the Permissions area...
Here again is the code I ran:
$serverName = "myServer"
$folderName = "d:\Users"
$shareName = $newSAM+"$"
$fullName = "\\$serverName\"+$folderName.Replace(":", "$")+"\$newSAM"
# Creating the Directory
$finalResult = New-Item $fullName -type directory
# AccessMasks:
# 2032127 = Full Control
# 1245631 = Change
# 1179817 = Read
$trustee = ([wmiclass]"Win32_trustee").psbase.CreateInstance()
$trustee.Domain = "domain"
$trustee.Name = "administrator"
$ace = ([wmiclass]"Win32_ACE").psbase.CreateInstance()
$ace.AccessMask = 2032127
$ace.AceFlags = 3
$ace.AceType = 0
$ace.Trustee = $trustee
$trustee2 = ([wmiclass]"Win32_trustee").psbase.CreateInstance()
$trustee2.Domain = "BUILTIN" #Or domain name
$trustee2.Name = "Administrators"
$ace2 = ([wmiclass]"Win32_ACE").psbase.CreateInstance()
$ace2.AccessMask = 2032127
$ace2.AceFlags = 3
$ace2.AceType = 0
$ace2.Trustee = $trustee2
$trustee3 = ([wmiclass]"Win32_trustee").psbase.CreateInstance()
$trustee3.Domain = "domain"
$trustee3.Name = $newSAM
$ace3 = ([wmiclass]"Win32_ACE").psbase.CreateInstance()
$ace3.AccessMask = 2032127
$ace3.AceFlags = 3
$ace3.AceType = 0
$ace3.Trustee = $trustee3
$sd = ([wmiclass]"Win32_SecurityDescriptor").psbase.CreateInstance()
$sd.ControlFlags = 4
$sd.DACL = [System.Management.ManagementBaseObject[]] ($ace, $ace3)
$sd.group = $trustee2
$sd.owner = $trustee2
# Creating the Folder Share
$finalResult = Invoke-WmiMethod -Class win32_share -name Create -ArgumentList @($sd, "", 4294967295, $shareName, "", "$folderName\$newSAM", 0) -computername $serverName -EnableAllPrivileges
I will change this manually so that I perform this on my laptop and report what results I get....

Set NTFS folder permissions

When creating new file servers we always need to set up the NTFS rights manually and that takes forever...
Instead I would like to have a powershell command/script that configures the NTFS security settings on the folders.
I have two needs that hopefuly some of you allready have a solution on,
1, NTFS Settings on a homefolder share:
Users should be able to access the location of all user folders (ex:
\\server\users\). Then the user should only be able to create folder(s). Without access to any other users files or folders. The user should have have full r/w access to his/her created folder.
Below you can see my settings as it is when I created it with Windows Explorer, how can I accomplish this this with Powershell instead?
2, I need the commands to set following NTFS settings on a folder:
A List Group: I want to add a AD group that should only be able to access the folder (not any subfolder or files).
A Read Group: I want to add a AD group that should be able to read all files and subfolders in a folder.
A Write Group: I want to add a AD group that should be able to read and write on all files/subfolders in a folder.
See sceenshot below how it looks today from Windows Explorer:

Hi,
First of all, thanks all for your quick answers to me..
I decided to go with
Mike Laughlin's answer. But I think I still need some more help from you all :)
This is what my script do:
I have a string that takes the computername and then remove the numbers in the end of the name to get the sitename (ex computername VEGAS001 will be VEGAS , which is the sitename)
On D:\Fileshares I have my folderstructure, here I create all department folders under the "sitename" folder (ex D:\Fileshares\Vegas\) with the script. This works fine to create...
Then the last is to set the NTFS rights on all the folders with the module Mike recomended.
Here I try to set rights on different groups, but it doesnt work with my string $sitename (ex: Domain\$sitename_L_HR_W = Domain\VEGAS_L_HR_W)
It creates a setting in the NTFS security , but it's not the correct one (see below) , its just a none existing GUID number..
I tried to add different symbols such as + " ' between/in the AD Group name
Ex: Domain\$sitename+_L_HR_R /
Domain\$sitename+"_L_HR_R" ,
but without any success
Sometimes it didnt add the GUID above, sometimes just a long error message that I couldnt understand.
I guess for anyone with some more PowerShell skills then me will be able to fix this easy? :)
Here is my code....
#Import the PowerShell Module (PowerShellAccessControl)
Import-Module PowerShellAccessControl
# Configure sitename as an string
$sitename = $env:computername
$sitename = $sitename.Substring(0,$sitename.Length-3)
# Create folder structure
New-Item D:\Fileshares\$sitename$\DATA\Administration\IT -type directory
New-Item D:\Fileshares\$sitename$\DATA\Administration\Finance -type directory
# Configure NTFS settings on folder
Get-Item D:\Fileshares\$sitename$\DATA\Administration\IT | Add-AccessControlEntry -FolderRights Read -Principal Domain\$sitename_L_IT_R -AceType AccessAllowed -AppliesTo ChildObjects,ChildContainers,Object -Apply -Force
Get-Item D:\Fileshares\$sitename$\DATA\Administration\IT | Add-AccessControlEntry -FolderRights modify -Principal Domain\$sitename_L_IT_W -AceType AccessAllowed -AppliesTo ChildObjects,ChildContainers,Object -Apply -Force
Get-Item D:\Fileshares\$sitename$\DATA\Administration\HR | Add-AccessControlEntry -FolderRights Read -Principal Domain\$sitename_L_HR_R -AceType AccessAllowed -AppliesTo ChildObjects,ChildContainers,Object -Apply -Force
Get-Item D:\Fileshares\$sitename$\DATA\Administration\HR | Add-AccessControlEntry -FolderRights modify -Principal Domain\$sitename_L_HR_W -AceType AccessAllowed -AppliesTo ChildObjects,ChildContainers,Object -Apply -Force

Active studio folder permissions

I am unable to set folder permissions in Shared Reports by using an ldap group to specify access, it only works when I set the folder permissions by using a specific ldap user. When I use the ldap group and login by the user which is a member of the group mentioned above I don`t see any folders. Is there a workaround possible ? Thnx.

That is strange. I think you are confusing confusing enterprise groups (e.g. LDAP) with BAM application roles (e.g. Administrator, ReportCreator, etc.). BAM only adds/synchronizes enterprise groups if those groups have assigned BAM application roles. This is done to make sure that users are assigned the correct BAM application roles even when the role is granted by virtue of membership in an enterprise group that is assigned that application role. This is done for both login and registerUser(), so their is no difference between the two regarding enterprize groups.
See section 23.3.3 on BAM application role vis-a-vis wls/ldap groups in "Managing BAM Guide" at http://download.oracle.com/docs/cd/E12839_01/integration.1111/e10226/bam_manage.htm#CIHJJGFJ

Timecapsule folder permissions

Is there any way to set specific folder permissions on a time capsule?
Currently our time capsule is being used as a work server and we would like to restrict access to certain folders for specific users - there seems to be no way to obviously achieve this.
Thanks in advance,
Stu

Yes, you can set the Time Capsule up to require an account name and password rather than use just the Time Capsule password. That would create separate user folders on the Time Capsule harddrive that can only be accessed by knowing those authentication details.
Note that if somebody has the admin password for that Time Capsule, they can disable this feature and make the backups visible for everybody, so make sure the Time Capsule password is secure and the base station is not in a location where somebody can reset it. The following articles talk about using this feature.
Mac OS X 10.5: Security tips for using Time Machine over a network
http://support.apple.com/kb/HT3446
Keeping Time Machine backups secure
http://docs.info.apple.com/article.html?path=Mac/10.6/en/21241.html

Group Folder -- Permissions Get Lost/Denied

We have a small LAN with a single group folder on an AFP network mount. The protocol is set to "inherent permissions" and I've promulgated this to the folder at least once. The owner is "admin" and the group is set to the short name of my workgroup. All (including "everyone") have permission to read/write. Every user is in the group. The acl list is empty, and the network mount is set to "use for: user home directories" (the latter because there is no option to select 'use for group folder.'
The folder is set to mount at login. (Users login at login, tho their homes are local.) All works fine, BUT after a while, the permissions to use the folder and its contents gets lost and the user is denied access.
A logout usually restores the right to use the folder, but this is driving me/my users crazy. Any aid much appreciated.

i'm seeing something very similar but not with a group folder. my users are constantly loosing their permissions on files within sharepoints that they should have access to. they have to log out of the server and log back in to restore the correct permissions.
is anybody else seeing this? it's becoming a huge problem and happens daily now.

I am trying to Consolidate Files out of a Sharepoint Folder

Hello Everyone. First off thank you in advance for the help. I had found a macro that worked very well for
consolidating a certain worksheet out of every workbook in the folder. This worked very well while the folder remained on our Shared network drive. Now, however, we are moving the folder to Sharepoint so more people can access and update the templates. My
issue now is I don't know how to make the macro reference a sharepoint folder. Can anyone help? Here is my current code.
Sub simpleXlsMerger()
Dim bookList As Workbook
Dim mergeObj As Object, dirObj As Object, filesObj As Object, everyObj As Object
Application.ScreenUpdating = False
Set mergeObj = CreateObject("Scripting.FileSystemObject")
Set dirObj = mergeObj.Getfolder("W:Merger Test")
Set filesObj = dirObj.Files
For Each everyObj In filesObj
Set bookList = Workbooks.Open(everyObj)
bookList.Worksheets("Forecast").Activate
Range("A4:IV" & Range("A65536").End(xlUp).Row).Copy
ThisWorkbook.Worksheets(1).Activate
Range("A65536").End(xlUp).Offset(1, 0).PasteSpecial
Application.CutCopyMode = False
bookList.Close
Next
End Sub
Here is my new code. (which doesn't work, error code 76 "Path not Found")
Sub simpleXlsMerger()
Dim bookList As Workbook
Dim mergeObj As Object, dirObj As Object, filesObj As Object, everyObj As Object
Application.ScreenUpdating = False
Set mergeObj = CreateObject("Scripting.FileSystemObject")
Set dirObj = mergeObj.Getfolder("//sharepoint/sites/portmgmt/Capability and Portfolio Planning/John's
Merger Test/PES")
Set filesObj = dirObj.Files
For Each everyObj In filesObj
Set bookList = Workbooks.Open(everyObj)
bookList.Worksheets("Forecast").Activate
Range("A4:IV" & Range("A65536").End(xlUp).Row).Copy
ThisWorkbook.Worksheets(1).Activate
Range("A65536").End(xlUp).Offset(1, 0).PasteSpecial
Application.CutCopyMode = False
bookList.Close
Next
End Sub

Firefox can handle its' own json and sqlite format for bookmarks/places, and it can handle the universal bookmarks.html interchange format, but it can't deal with the Favorites .url format - that's unique to IE and its' clones. Get that folder of .url files back into Internet Explorer and then export that data as an HTML file.
In IE: <br />
File > Import/Export - Export to HTML file
''then in Firefox:'' <br />
Bookmarks > Organize Bookmarks -> Import & Backup - Import HTML... = From HTML file

Advise about setting up a permissons on Lion server for a small office.

What is the common wisdom and advise about setting up permissions optimally for a small office using OS X Lion Server as a file server? I thought I had this solved by setting the ACL permissions so that all users and appropriate groups can read and write all files on the server. This works great until a new file is created. Then it appears that the POSIX umask kicks in and takes priority over the ACL permissions. I need to allow group write permissions on all new files. My options seem to be:
Make everyone an admin - not great for obvious security reasons
Change the umask for the whole machine - also security problems, though perhaps fewer than the everyone-an-admin route above
Write a folder action applescript to add group write permission on all new files. This works fine if you have a static number of folders With new folders it has the problem: How do new folders created by non-admin users get this folder action automatically applied to them - some cronjob to hunt down the new folders; an applesscrpt folder action that adds a folder action to all new folders (sounds recursively complicated)?
Have a cron job regularly do something like `chmod -R 664` on all files. This will break during those between the cracks times between when someone creates a new file and when the cronjob runs - not ideal.
Seems like this should be easier which makes me think I'm missing something obvious.
Any help great appreciated. Thank you in advance!

Good-heart's advice is certainly your first step, but if you've already done that and still have the problem you've described, you might have the 10.7.3 ACL bug, particularly if your users and groups are in an OD or AD rather than being local accounts on the server. The problem is that ACL's for directory accounts are incorrectly ignored, resulting in POSIX permissions coming into play.
I've descibed my workaround for this here;
https://discussions.apple.com/message/18037703
I haven't yet tried the other trick I've read about, which is to ensure your Share's data directories are at least one level down on the volume - there is a post here on the Communities that mentions this;
https://discussions.apple.com/message/18028746
I seem to remember that this helped with an earlier version of AFP, if using external firewire or usb storage.
Let us know if you find a fix, it seems a number of people have problems with this.
Regards,
Ian

File and folder permissions for Adobe Photoshop CS5

Good day,
I am an IT specialist and I work for a Canadian governement agency and we are having an issue with Photoshop CS5. After successfully installing Photoshop CS5 from the Adobe Creative Suite 5 Design Premium set(using a local machine administrator account), Photoshop crashes immidiatly after launching it(even with the local administrator account). The exact error message is as follows:
The instruction at "0x230dad8dc" referenced memory at "0x00000000". The memory could not be "read".
Click on OK to terminate the program
Click on CANCEL to debug the program
I know this is an environement issue and not an application or hardware issue since I was able to successfully install and run Adobe Photoshop CS5 on a plain vanilla install of Windows SP3 XP on the same model of workstation(HP DC7800). This later also confirms it is not a RAM or video adapter issue either. My experience tells me it would be more related to file/folder permissions on the workstation(although I'm open to other suggestions). Because we are a governement agency, our workstations have machine and user policies and desktop configurations that get applied to the workstations automatically upon joining our domain via GPOs and SMS. Certain system files and folder permissions may be locked down for security reasons therefor I was wondering is someone has a list of files and folders that Adobe CS5 needs access to upon startup in order to properly function?
If anyone would like more details or information please let me know and I'll try to be more specific.
Thanks in advance to all who take the time to read and help out!

I appreciate that you're trying to surmise what's different, and it's good that you have had success with similar/identical hardware. At least you know it can work.
However, I wouldn't bet just yet that it's a permissions issue. I'd think you should get a specific error if a locked-down file needed to be accessed, not a null pointer crash. The Photoshop installer should be setting up the proper permissions on its own files for it to run.
Is it exactly the same video card as the other computer, on which Photoshop works?
Are you sure the video drivers are up to date with the same version as on the other computer?
At exactly what point during startup does the failure occur (i.e., is the splash screen showing, and what does the status line in the splash screen say it's doing)?
-Noel

How to set default file permissions for applicatio...

I have the nokia n86 and was wondering if there was any way of setting the file permissions of a program via the phone. To put it in context, i downloaded a program that edits photos but everytime i try to load a picture from my phone it asks me (for every single folder in my phone, not just the photo ones) if the program can open it. I can be there clicking yes all day as i there is a lot of folders and subfolders on the phone. I know sony ericssons had an option where you could select the programs permissions to always ask or never ask but i cant seem to find a similar option on the nokia.
Does anyone have any ideas?

Same issue here. Everything I put on the drive is set to Read-only for the group.

Setting MS Access Permissions

I have a MS Access 2013 web app hosted on the Microsoft Office Sharepoint 2013 site. I want the team members to be able to add/modify/delete only within the web forms. How do I set permissions so that other team members cannot delete or update
the actual application and the application data outside of the web form? What permissions should I use? I tried to create a new group with custom permissions, for example group "XYZ". When I tried to add permissions to group "XYZ",
I was not given a choice of using the custom permissions that I set up.
Thank you in advance.

Hi,
According to your post, my understanding is that you wanted to set Microsoft Access Permissions.
If you already created an app and now you've decided you want your app to have unique permissions from the site where you created it, see Set
permissions for an Access app on Office.com.
More information:
Set permissions on an Access Web App
Set permissions for an Access App - SharePoint 2013
Best Regards,
Linda Li
Linda Li
TechNet Community Support

Question about folder permissions

I have set up separate user accounts for myself (as administrator) and my wife and four kids (a total of six user accounts). After having problems in iTunes and iPhoto with messages regarding "locked disk, or no access" I created a group called "family" which includes all the user accounts plus admin and root. I then changed the folder permissions for all the user subfolders (and their subfolders) to be as follows:
owner = Eric, access = read & write
group = family, access = read & write
others = read only
(Note that the folder permissions for the Users folder itself are the original ones, i.e., owner = system, access = read & write; group = admin, access = read & write; others = read only.)
Are the changes I made unnecessary or incorrect? An alternative scheme that was recommended by someone in a thread pertaining to the iTunes "locked disk" issue was the following for a given user (presumably someone other than the administrator):
owner = (user name), access = read & write
group = (user name), access = read only
others = read only
Any comments/advice will be welcome.

Hi Eric55,
I want to suggest two things:
You yourself should use a non-admin account for daily
work. An administrator should administrate, and
should not write a letter. This would reduce risks of
malicious software doing bad things to your whole
system (since it would have your admin rights) and
you yourself doing bad things without noticing (like
deleting important files accidentically just because
you can do so without warning).
Many thanks for your very helpful reply. I can see the wisdom of what you're suggesting. So, should I just create another account, e.g., called "Eric2," that I use for routine work, leaving the "Eric" account that has admin rights alone except when needed for admin tasks?
Regarding your question with folder permission: There
is a folder named "Shared" that should hold all the
files that everyone needs to have access to. The
important bit is that the files in it must also be
available to everyone.
I had understood from the book I bought ("Mac OS X, The Missing Manual, Tiger Edition," by David Pogue) that all users have access to the Shared folder and its contents. In fact, this is how I got into this whole issue of folder permissions. Pogue's book suggests putting music (MP3) files into the Shared folder (rather than leaving them in each user's Music folder) so that all users can share them in iTunes (after switching the iTunes music folder location to the Shared. . . folder). I did this, but then my son, working from within his user account, was unable to copy the contents of a music CD into the Shared folder. That got me started on what seems to have been a misguided effort to expand folder permissions so that he (and other users) would have read & write access to the Shared folder, not just read only access.
But once I did that, the kids starting having problems with iTunes and iPhoto from their user accounts. For example, a common problem was that when trying to open iTunes they would get an error message saying that iTunes was on a locked disk or they didn't have permission to access the folder. This didn't make sense, since I thought I'd expanded their access rights sufficiently by putting them in a "family" group and giving that group R&W access. So at that point, I concluded that I didn't understand permissions well enough!
And for this a common group is
alright, but Mac OS does not do this automatically;
all files copied there must be changed manually (or
by a folder action Apple Script, if you know how to
do this) to this group and have the proper rights
set.
That's what I thought I'd done with my "family" group, but that seems to have created more problems that it solved.
BTW, I would not put admin or root users in this
common group, again out of caution.
OK, makes sense.
And user folders
should belong to users, not to everyone. Just my
thinking ...
Again, what I was basically trying to accomplish was to have all the music files in the Shared folder, but at the same time make it possible for individual users to add music to the Shared folder. Maybe you have some suggestions for how to do that, and for how to revise the permissions I set up, e.g., to put them back to how they were before. If so, many thanks in advance!
--Eric

Default File and Folder Permissions

Hello everyone,
Is there anyway to set a default file/folder permissions for a parent folder and then if any new files or folders get created within that folder that files use 0644 and folder use 0755? I'm running MAMP for a localhost test site to run Joomla CMS, I have the parent folder set to 0755 but when ever I install a new extension in to Joomla the files are not writable. Is there a way I can set the main parant plublic_html / www folder to work like this for new child files and folders?
Thanks guys.

Send Apple feedback. They won't answer, but at least will know there is a problem. If enough people send feedback, it may get the problem solved sooner.
Feedback

QTSS file and folder permissions

I am having a lot of problems getting QTSS and QTSS Publisher working correctly. I think this may be due to file and folder permissions. Does anyone know what the correct ownership and access settings should be for the folders containing my quicktime files?
Thanks.

Try setting the ownership and permissions of those files to the ones mentioned on the end of this page, which are: owner: qtss, group: admin, permissions for owner and group: Read & Write, and Read only for others.
(13414)

Setting SharePoint folder permissions

Similar Messages

Maybe you are looking for