File Server NTFS Permissions question

I am in the process of reconfiguring a file server for my company. It
is a Windows Server 2003 / Enterprise x64 Edition SP2

I have created a share called 'Shares' (\\servername\shares) that will
have 3 subfolders that are not shares, just subfolders.

One these subfolders is named 'Departments' and it represents a
logical division of departments in my company. (i.e. Accounting,
Finance, etc..)

Share permissions to the 'Shares' share are:
Domain Admins = Full Control
Domain Users = Change | Read

I have a network drive mapped for users to '\\servername\shares
\departments' = K:\
Users will see a list of department folders when browsing to the K:\.
For K:\ the permissions are as follows:

The NTFS permissions on the 'Departments' directory are as follows:
Domain Admins = Full Control (This Folder, Subfolders and
Files)
Domain Users = DENY -> ('This Folder Only') Create
Files / Write Data | Create Folders / Append Data
| Delete | Change Permissions |
Take Ownership
Domain Users = ALLOW -> ('This Folder Only') Traverse
Folder / Execute File | List Folder / Read Data


Each of the department will have their own subfolder of K:\ that will
have explicit permissions enforced by global security groups in Active
Directory. For example, I have

'\\servername\shares\departments\accounting' or K:\accounting and the
Accounting group members have access to this directory. NTFS
permissions to K:\accounting would be:
Domain Admins = Full Control (This Folder, Subfolders
and Files)
Accounting = DENY -> (This Folder Only) Delete
Subfolders and Files | Delete | Change Permissions | Take Ownership
Accounting = ALLOW -> (This Folder Only) Traverse
Folder | List Folder | Read Attributes | Create Files | Create Folders
| Write Attributes | Read Permissions
Accounting = ALLOW -> (Subfolders and Files only)
Allow is checked for everything except for Full Control and Take
Ownership

User John Doe (who is a member of the accounting group) is able to
browse/traverse K:\accounting and create subfolders and files. John
Doe is not able to delete the parent folder

'Accounting' or other department folders that he doesn't have
permissions to (which is what i want). He also is unable to create
new folders within K:\ (this is what i want as well).

However, when John Doe attempts to delete the 'Accounting' parent
folder, it displays this error - "Error Deleting File or Folder -
Cannot remove folder Accounting: Access is denied.

Make sure the disk in not full or write-protected and that the file
is not currently in use." - This is as I would expect, but then it
still deletes subfolders and files within the Accounting

folder!! Why???

Shouldn't the subfolders and files remain intact? Is there a way to
prevent this behavior, but still allow users to traverse the K:\?

I would like users to be able to create subfolders and files within
their department folders but they should NOT be able to delete the
parent department folder or create new

subfolders in K:\ only within the department folders.
The reason I have these department folders within the Shared Folder is
that we have many users that need access to multiple department
folders. I don't want to have to map a

network drive for each department folder that a user would require.

Many thanks for your help and insight
.

Relevant Pages

  • Re: Default permissions for the "Default User" account folder
    ... > I gather that Windows uses the permissions from this ... > folder when adding new user accounts. ... > Full - Administrators - This folder, subfolders, and files ... and have created several templates ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Why do some folders/registry keys have 2 permissions instead of 1?
    ... > I'm trying to write a script that will compare permissions for a large ... But if you check the folder or registry key's ... > group/user when it only needed to save one ACE. ... > gives Full Control to myuser for subfolders and files, ...
    (microsoft.public.win2000.general)
  • Re: Why do some folders/registry keys have 2 permissions instead of 1?
    ... > I'm trying to write a script that will compare permissions for a large ... But if you check the folder or registry key's ... > group/user when it only needed to save one ACE. ... > gives Full Control to myuser for subfolders and files, ...
    (microsoft.public.win2000.registry)
  • Re: Why do some folders/registry keys have 2 permissions instead of 1?
    ... > I'm trying to write a script that will compare permissions for a large ... But if you check the folder or registry key's ... > group/user when it only needed to save one ACE. ... > gives Full Control to myuser for subfolders and files, ...
    (microsoft.public.win2000.security)
  • Re: NTFS Permissions
    ... > I want to be able to secure my network file shares through NTFS permissions so that users cannot accidently delete subfolders or the root foler of their file share but have come across an interesting problem. ... > Then I have a test group called test1 with a bunch of users in the test group and I apply this group to have modify permissions on the test folder. ... Grant the users Read, Write, and Execute perms on the given folder, ...
    (microsoft.public.windows.server.general)
Loading