Permissions. Best practice?

First of all - great site!

I have a little problem. Can you please help me? I already passed 70-270, but I feel myself bad in permission's questions. Hope for you help.
Situation:
I have a root folder, which name is Sales (for example).
Sales have two subfolders - Managers and Representatives.
Two managers (they are not in the group) must have all necessary permissions on all those folders, and two representatives (they are not in the group, too) must have permissions only for Representatives folder, and must not read content of Managers folder.
Questions: I don't want anybody can delete any of those 3 folders, so I can't give "Modify" permissions for Sales folder, and after assigning "Modify" I must go to the Advanced tab, and check "Delete subfolders and files", and uncheck "Delete" special permission. Am I right?..
And second question... I do that for both managers on Sales folder, so they can do anything they need on all folders (I use inherit on Sales, so receive the same on Managers and Representatives sub-folders).
I gave two representatives only "List folder Content" for Sales and "Modify" + "Delete subfolders and files" for Representatives folder, and before that I uncheck Inherit from Sales. So I get what I need... But I think it's a bad, wrong way... Please, say me what you think...

P.S. I'm sorry for my English, it's not my native language.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

Mishra

#1
Sales
Managers: both managers have modify
Representatives: both managers have modify, representatives have read

This is the answer from what I got with your question. I doubt it is the right question though. If you don't want people to delete then set the permissions as read/write.

#2
You can set your permissions on the Sales folder and have it propagate down to the other folders. You don't have to set the representatives on this folder. Just apply permission to the folder(s) you need.

arvalea

Mishra wrote:

#1
Sales
Managers: both managers have modify
Representatives: both managers have modify, representatives have read

This is the answer from what I got with your question. I doubt it is the right question though. If you don't want people to delete then set the permissions as read/write.

Thank you for answer.
But I can't give Modify, because users then receive "Delete" permission and can delete anything include main subfolders. But they must be able to delete some files, and folders in the subfolders.
And I can't give them only Read\Write permissions, because they then can't delete some old files... So I need go to the Advanced and give them the "Delete subfolders and files" permisson?..

Mishra

You can select "Apply onto: This folder only" to modify permissions specifically on the folder you are applying it to. You can also select "Apply onto: Subfolders and files only" to exclude the parent folder.

But your criteria in the question is what is confusing me.
You have:

\Sales
.......\Managers
.......\Reps

You don't want anyone to delete any of the 3 folders (or all folders?). So on the sales folder select "This folder and subfolders" and apply the deny permissions for all involved parties. If you want to only specify one folder then you need to use the "this folder only" option on the 3 folders listed above.

arvalea

Mishra wrote:

I'm sorry for delay

- thank you for your answer, Mishra!

MikeInMoseley

Just to point out that this would be beyond the scope of the usual 270 questions. This would be 290 & beyond TBH.