Hi All, Currently i'm setup a network share folder in my network. My client pcs all are join to domain. I just want to let user can access and read to share file but to deny them to copy the folder or file to their location. Do Windows server 2008 R2 can configure to deny user copy? If can, how do i configure to deny users to copy out folder and file? Or i just need to set to deny write? Thank Regards,

This is not possible by design. 'Read' implies 'copy'. In fact, reading is copying.MCITP: Enterprise Administrator; MCT; Microsoft Security Trusted Advisor; CCNA

Copying a file requires only read permission on the original file, so we may not able to prevent users from copy the files they can access. Shaon Shan |TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tngfb@microsoft.com

As said, it is not possible in that way. Think of connecting the users to a remote server where the documents reside using RDP and configuring the security settings so that they can access only the required files, this can be an alternate solution.MCDST, MCSAS, MCSES, MCDBA, MCITP, MCTS, MCT

Hi All, I have some permission assign question. For example i have 5 users in Account department. i Want to assign permission to a folder name "Doc" as below. User1 Read and Write User2 Read only User3 Read only User4 Read only User5 Read only I create a group name " account" and add all the user1 to user5 as member for "account" group. How i want to assign read and write permission for user1 to folder "Doc"? should i assign read permission for "account" group and then create another group for user1 with read and write permission? Thank Regards,

You may choose to assign Write permission onto User1 as long as this is permanent user which won't change his/her position in a company soon, and there is no some assistant planned for him. Otherwise, I'd created a group called "Accounting Documents Managers" and assigned permission to that group.MCITP: Enterprise Administrator; MCT; Microsoft Security Trusted Advisor; CCNA

Hi, For my situation it's mean i need to create 2 groups? separate user1 from "account" group? OR Create a group for user1 to user 5 assign read only as "Account" group. Another group name"Accounting Documents Managers" for user1 and assign write permission? Just want to know the best practice of assign permission. Below is my design. Acc Department Folder1 Folder2 Folder3 User1 Authorized For Read & Edit Read & Edit Read Only User2 Authorized For Read Only Read Only Read Only User3 Authorized For Read Only Read Only Read Only User4 Authorized For Read Only Read Only Read Only User5 Authorized For Read Only Read Only Read Only Thank Regards,

Best practice is to have two local groups and assign permissions through domain Group Policy. In your situation, you may choose any solution. It's not that big difference for you.MCITP: Enterprise Administrator; MCT; Microsoft Security Trusted Advisor; CCNA

Hi, I will create 2 separate groups, a assign permission accordingly. Thanks