Windows 10: Windows Security. Allow user access only to subfolder and not root

I've tried to search about this there and here, but hadn't found a solution.

SITUATION
I have a following folders structure:
root
----|A
----|B
--------|B1
--------|B2
----|C
I need to give permission for user to access only folder B2 and deny access to any root folders. I want to lock user inside this folder.

WORKAROUND
After reading this, I almost achieved it doing these two steps:

• I gave the only "Traverse Folder/Execute File" permission for desired user to root folder and forced this permission to all subfolders.
• I disabled inheritance for folder B2 and gave "Full control" permission for desired user.

In this way user can't access root folder's content, but can access B2 folder directly through direct link or shortcut.

PROBLEM
The problem is that user can get one directory "up" from his folder and see root folder B with subfolder B1 along with B2. He can even go inside B1 directory and see all files inside. Although he can't access main root folder root - Windows shows "Access denied" error. Windows Security was always very messy but now I'm out of ideas.

:)

 

Subfolder permissions

I am the only user and administrator for my desktop. I have an external HDD that I use for phot and video storage instead of my desktop hard drive. I have suddenly lost permission rights to the picture subfolder. If I go to Properties, security and try
to change permissions there is only one user and they do not have write access. The option to add a user is not available. the option is light grey. The root directory above this sub folder is fine; the sister subfolders at peer level are fine. I have heard
this is a common windows 10 problem. It is very frustrating.

 

How to allow creation of subfolders/files but disallow renaming the folder itself

Hi!

With a certain folder I want to allow creation of subfolders/files but disallow renaming the folder itself.

What I tried:

Allow for subfolders and files, only: Full access.

And:

1) Allow for folder, only: 'Read, Execute' + 'Show folder content' + 'Read' + 'Write'.

Result: The user can create subfolders and files (ok), but also can rename the folder itself (not ok).

2) Allow for folder, only: 'Read, Execute' + 'Show folder content' + 'Read' + 'Write', except 'Write attributes' or 'Write advanced attributes'.

Result: The user cannot rename the folder itself (ok), he can create subfolders (ok), but he cannot create files (not ok).

How can I prevent the folder itself from being renamed, while subfolders and files can be created?

Thank you for any useful hints in advance!

Kind regards,

Gerald

 

First Disable inheritance on B2 and setup your permissions for the user.

Then go to Root, Disable inheritance from the parent and remove or deny that user's access.

*Arrow Enable or Disable Inherited Permissions for Objects in Windows User Accounts Tutorials

 

Thank you, TairikuOkami.

PROBLEM
It works in your case, but at the time I didn't realize that my folders are CIFS shares in NAS (Network Access Storage). NAS has UNIX-like OS so looks like the file system and security descriptors are entirely different from Windows. And in my case with your solution user can't access subfolder B2 directly - I get Access is denied.

WORKAROUND
I can achieve your result in my case with "Traverse Folder/Execute File" security option for root and all subfolders enabled, as I described in my first post. But in this case user can't access only root folder's contents. All other subfolders in different level can be accessed. It's interesting, that user still can access the B folder even if I disable inheritance of B and entirely remove user from the list.

CONCLUSION
NAS and Windows Security systems between themselves do not work properly. At this point I'm curious how they managed this to work at all... *Smile