Setup Mac Server

Question

Hello,
I have been ask to administer a Macintosh server, and while I do know Macs pretty well, I think I may be in over my head on this one.
The Server is a PowerMac G4 running Mac OS Server 10.2.8. I know it’s old but that’s what I have to work with. I think for what we need it should be enough.
I’ll try to explain the present Server setup (as it was when I began working here 3 years ago).
I work for a collection of medical research labs, each with a P.I. (primary investigator) and lab members. The way it was setup before I arrived is, each lab had an account, everyone in the lab would sign on to the Server using the same Laboratory account name & password. Each member could move files in and out at will. Everyone in the lab had access to everyone else’s files.
Now they want to give each person their own account. They want the P.I. to have access to all lab members data, but lab members to only have access to their own files. No more exchanging files between lab members.
The only thing I can come up with is to give each person an account, then make each lab member also a group, except the P.I., they would only have a personal account since no one else needs access to their data.
I then add the newly created lab member groups to the P.I.’s account so they can access their lab members data. This also isolates the lab members from each other.
I setup a share point for each account to their respective folder on the Server. In the share point the Owner and the group would be the same, this allows the P.I. to have access to the files (because I added each members Group to the P.I. account) as well as the actual owner.
I know this way will work because I tried it with the smallest Lab (P.I. + 4 members) we have.
But that was only 5 people. The 6 labs I need to setup would total around 80 accounts, plus a Group created for everyone minus the 6 P.I.’s. I would end up with over 70 groups!
Even now with only 6 accounts (one for each Lab)on the server I run into permission problem. About once a week I have someone calling me saying they are being denied access to a file someone else placed on the Server. I can go to the server and fix permissions easily using the Workgroup Manager. But, with 80 accounts I’m afraid this will become a permissions nightmare. Not to mention the Lab members come & go frequently, meaning I will be deleting and adding new account all the time.
Is there a better, easier or less complicated way to do this?
Thank you
Example:
*Johnson Lab: Primary Investigator -Dr. Eric Johnson*
* Lab Members- Robert, Mike, Alice & Steven*
*1)Dr. Johnson needs access to his own files in his personal folder, as well as all folders and files within of each Johnson Lab member.*
*2)Lab members should have access to their own folder & files only.*
If you have read this far you’re a Saint.
Thank you

Answer 1

Hello Lucid7,
If I were you I would draw your needs in the simplest schema possible. I would use layers for distinguishing services from permissions from user and groups and so on. You demands aren't exotic or impossible but sound rather cluttered and are the cause of user request.
The schema might provide you some additional insights, gaps and additional requirements. Bottom line things you didn't think of.
Also you might want to invest some time in studying:
+ document management system (e.g. http://www.alfresco.com)
+ update to a more recent server version as ACL have more options and are becoming more mature each server iteration (if cost is an issue, look at eBay) (10.2?)
+ inherent grouping (10.2?)