Give Access to a Subdirectory Without Giving Access to Parent Directories
- by allquixotic
I have a scenario involving a Windows file server where the "owner" wants to dole out permissions to a group of users of the following sort:
\\server\dir1\dir2\dir3: Read & Execute and Write
\\server\dir1\dir2: No permissions.
\\server\dir1: No permissions.
\\server: Read & Execute
To my understanding, it is not possible to do this because Read & Execute permission must be granted to all the parent directories in a directory chain in order for the operating system to be able to "see" the child directories and get to them. Without this permission, you can't even obtain the security context token when trying to access the nested directory, even if you have full access to the subdirectory.
We are looking for ways to get around this, without moving the data from \\server\dir1\dir2\dir3 to \\server\dir4.
One workaround I thought of, but which I am not sure if it will work, is creating some sort of link or junction \\server\dir4 which is a reference to \\server\dir1\dir2\dir3. I am not sure which of the available options (if any) would work for this purpose if the user does not have Read & Execute permission on \\server\dir1\dir2 or \\server\dir1, but as far as I know, the options are these:
NTFS Symbolic Link,
Junction,
Hard Link.
So the questions:
Are any of these methods suitable to accomplish my goal?
Are there any other methods of linking or indirectly referencing a directory, which I haven't listed above, which might be suitable?
Are there any direct solutions that don't involve granting Read & Execute to \\server\dir1 or \\server\dir2 but still allowing access to \\server\dir1\dir2\dir3?
