Thursday, August 17, 2017

NTFS permissions to allow users to create their own home folders

In Active Directory environments, it's common to give each user a home folder where only the owner of the folder can work with the contents. The "Active Directory Users and Computers" tool can automatically set a user up with Full Control of their assigned home folder, but it's also possible to make a folder under which newly created folders will automatically be made home-like.

First, disable inheritance on the topmost folder and do not copy inherited entries. Then add these access control entries:

  • Allow SYSTEM full control over "this folder, subfolders, and files"
  • Allow Administrators full control over "this folder, subfolders, and files"
  • Allow Users "list folder contents", "read & execute", and "read" on "this folder only" (or "this folder, subfolders, and files" if you want everyone to have read access to each others' stuff)
  • Allow CREATOR OWNER full control over "subfolders and files only"
  • Allow Users "create folders / append data" on "this folder only"
The last entry is what allows users to create their own folders, while the second to last is what gives them full control over the contents.

No comments:

Post a Comment