A new folder is required - permissions??

workaccount

Our buying department have terms and conditions documents and accounts want a new folder in which buyers only have write access to put this into to prevent stuff get stolen et cetera. In other words accounts want buyers to put files in the folder for them to see but they dont want the buyers to be able to see them again.

I think the only problem I have is implementing a solution where "once a user adds this file to the directory it will automatically take on the rights of someone else- that someone being in the accounts department."

seamus

OK. You need to specifically set permissions on the files and then do some testing.

Delete the existing ACL on the folder. Add the Domain Admins group and give them full control. Add the accounts group and give them read-write access. Add the buyers group and go into the advanced settings. Give them only one permission - "Create Files - Write Data".

This should ensure that they can only copy a file in, and nothing else.

workaccount

Seamus: You might be able to tell me what im overlooking here.

Right i'll start from the active directory. I have set up a test buyer (buyertest) in the Buyers OU. I have then added the buyer to the "Buyers Sec Grp".

I also set up an "accountstest" and added to the Accountants security group.

Ok in my shared folder then on the fileserver, lets call it "T&Cs Folder" I have three groups added to the security permissions, "Head accounts" (a security group btw), Buyers (Security group) and Admins.

Admins obviously have full control. "Head Accounts" have read and write permissions. Buyers have special permissons in the advanced screen namely "Create files / Write data" & "Create folders / Append data"

After writing the above I have just verified everything and the the group policy has been updated.


So everything should work, right?
When I log in with my "Test buyer" account, It pops up a message saying I do not have the permissions to access this folder.

seamus

That's because the Buyers Sec Group don't have access to View the folder - only to create items in it.

An easy way to test this is, as the buyertest user, create a bog standard text file, say on the c:\

Then from a command prompt, type
copy c:\example.txt "\\server1\Sharename\folder\"

The file should get copied in successfully. If you want users to be able to browse to the folder and drag and drop, then you'll need to give them the "List Folder Contents" permission too. This will allow the users to see all of the files in the directory, but not open or change them.

workaccount

It didn't copy over through cmd. It just said access is denied. I now have the advanced permissions turned off and have just "list folder contents" & "write" selected and still...no joy.

seamus

What about the Share Permissions?

The Actual Permissions are caculated by looking at the Share Permissions and the Folder Permissions, and applying the most restrictive of the two.

Often when you set up a new share, the default is to give Domains Admins full control, and Everyone else read only.

workaccount

seamus wrote:

What about the Share Permissions?

The Actual Permissions are caculated by looking at the Share Permissions and the Folder Permissions, and applying the most restrictive of the two.

Often when you set up a new share, the default is to give Domains Admins full control, and Everyone else read only.

I have also added in Admins, Buyers and Accountants to the share permissions and given them all full control.

I must have made some stupid mistake somewhere along the way. Ill look into it in the morning with fresh eyes.
Thanks again Seamus.

workaccount

Im back on this today now and its really wrecking my head.

Im forgetting about adding the buyers to my folder and just trying to setup the accountants permissions right first which is full control.

Im basing my permissions now at the moment on the "Head accounts" folder. In fact ive copied them completely. When logged in as accountstest I can only view the "head buyers" folder but cant create a file. I get unable to create the file...access is denied.

However when logged in STILL as accountstest, I can access the head accounts folder, read write and everything. They appear to have the exact same permissions though!

workaccount

Ok, this is sorted now actually. When I started on the folder today and immediately starting running into the same problems as the last time; I quickly got frustrated which led me to forget to check the sharing permissions.

I'll never forget this again!

workaccount

Hmmm, still one more issue I need to resolve. Buyers can overwrite existing files now in this directory. I need them to be able to write but not overwrite.

Can this be done?