We have a folder foo whose contents are available to all members of group foo.

One folder, bar, within foo must be allowed to group foobar, but group foobar must not have access to any other folders within folder foo other than bar.

Permissions on bar must not change for group foo yet allow group foobar into bar...that is, inherited permissions etc. can not be deleted.

What is the correct way to set permissions??

For now I added group foobar to the permissions for folder bar and did not change anything else.

Thank you, Tom

It sounds like you need to grant "Traverse Folder" permission to group foobar, upon the folder foo:

https://technet.microsoft.com/en-au/library/cc787794(v=ws.10).aspx

Hi,

Auy update about the issue?

Regards.

Dear Moderators: Please do not decide for the OPs what are the correct answers.

Thank you, I thought of this several hours after posting my question, I will try that...

Thank you, Tom

This is not the full answer...testing still gives access denied.

The root is \\fp1\foo, with the foobar group's permissions set to list folder and traverse folder for this folder only.

\\fp1\foo is mapped to drive letter S:\

The \\fp1\foo\bar folder has full control permissions given to foobar.

The foobar group still gets access denied, why??

Thank you, Tom

P.S. Dear moderators: Please do not choose anything here as the answer until the OP (me) says it is the answer. Thank you.

The root is \\fp1\foo, with the foobar group's permissions set to list folder and traverse folder for this folder only.

\\fp1\foo is mapped to drive letter S:\

The \\fp1\foo\bar folder has full control permissions given to foobar.

The foobar group still gets access denied, why??

Did you set the Sharing permissions on \\fp1\foo (not NTFS security permissions) to be Everyone=Full ?

Did the users within the group "foobar" logoff & logon, to refresh their token (after permissions were set)?

When you logon as admin of the server, you can use the Permissions | Advanced | Effective Permissions, to check the resultant/effective permissions for an example user member of group foobar.

Does this server have Access-Based-Enumeration enabled (it should not be necessary)?

Is this server running Windows or some other OS with CIFS emulation/SAMBA ?

The root is \\fp1\foo, with the foobar group's permissions set to list folder and traverse folder for this folder only.

\\fp1\foo is mapped to drive letter S:\

The \\fp1\foo\bar folder has full control permissions given to foobar.

The foobar group still gets access denied, why??

Did you set the Sharing permissions on \\fp1\foo (not NTFS security permissions) to be Everyone=Full ?

Did the users within the group "foobar" logoff & logon, to refresh their token (after permissions were set)?

When you logon as admin of the server, you can use the Permissions | Advanced | Effective Permissions, to check the resultant/effective permissions for an example user member of group foobar.

Does this server have Access-Based-Enumeration enabled (it should not be necessary)?

Is this server running Windows or some other OS with CIFS emulation/S

Hi,

I just want to confirm what is the current situation.

Please feel free to let us know if you need further assistance.

Regards.