NTFS Folder Permissions using Active Directory

  • Thread starter Thread starter beepeeoh
  • Start date Start date
B

beepeeoh

I have a group of users who are all in an AD group called "Performance
Managers". Each user belongs to a seperate division, so are also in
divsional AD Groups, "AA","BA",etc.

I'd like to restrict access to a set of folders to just the performance
managers for each division without having to create more groups.
What I'd like to have is a structure like:

\PerfomanceManagers\AA\ --> Only accessible if in both Perfomance
Managers group AND AA group
\PerfomanceManagers\BA\ --> Only accessible if in both Perfomance
Managers group AND BA group
etc.

though the folder structure can be changed to suit. I've tried allowing
access to the PerformanceManagers folder to the Performance Managers
group, then setting the divisional folder to the divisional group, but,
if a member of the divisional group who is NOT a perfomance manager
knows the folder path, they could go straight into it.

Sysadmin isn't my forte, so your help is appreciated.

Cheers

Ben
 
Sorry, but I think you're going to have to create more groups. NTFS
permissions are based on security identifiers (SIDs), which are individually
associated with user and group accounts. When a user logs on, an access token
is created for that user, and the access token contains the SIDs associated
with that user (among other things). Every user account has a SID. When you
add a user to a group, the group's SID will be added to the user's access
token the next time the user logs in.

When you try to access an NTFS protected resource, the system compares the
SIDs on your access token with the SIDs on the Access Control List (ACL) of
the resource. If it finds a match for what you are trying to do, it will let
you do it. In order to restrict access on the AA folder to just AA managers,
they need to be in their own group, and that group needs to have access to
the folder, with the Performance Managers group not on the ACL.

What Are Access Tokens:
http://technet2.microsoft.com/Windo...38a0-4aa5-b1d7-c9b42cb4df941033.mspx?mfr=true

I hope this helps.

Steve
 
I thought this would be the case. I guess I'm too used to be able to
switch an OR for an AND. Maybe when MS bring out their relational
filesystem, eh!

Thanks for your help.

Ben
 
Back
Top