Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).
-
Hello All,
Looking to make life easier with some solution which can give good control over the shared folder permissions for Windows shared folders.
Note: As you know, the behaviour of Windows File System with applications like Microsoft Application Suite, AutoCAD etc. that whenever you are trying to rename or edit file from Windows it will create a temporary file and once we click save, it will append the changes and delete temp file. So wherever user needs to Edit/Rename, we need to give Read,Write and Delete Permission.
This is how one of our Shared Folder looks like, but it's more deeper and complex, bcuz of being lazy
I just make it simple, hope you will understand 
Difficulty/Problem I have:
-
Managers asks me to give full permission to specific department for specific folder (child folder) and they should only able to view the files from other departments (which is necessary too). Same thing applies to all projects. And we cannot divide the files/data in Department to make it easier to give full and only view access, as all data for one project should be in one location.
-
In some scenarios, I have to give users access to view/edit/rename but not delete.
Solution require :
a. Do not want to change how users are dealing now, which is accessing shared folder with Windows Explorer or Drive mapping. I guess some solutions have accessibility with browser instead of Windows Explorer which changes current approach.
b. Maybe some solutions like LogicalDoc, Alfresco can do this ?
c. We have lots of data on file server (shared folder) and projects (sub folders), about 4TB of data which may needs to be considered while looking at solution ?
Looking for suggestions from you people with a hope to make my IT life easier.
-
-
This is interesting.
I'm curious how you change this without changing the current workflow of your users.
-
I'm not familiar with a product that would allow you to do this in a way that is not extremely time consuming. Interested to see if anyone else does.
-
@Dashrender said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
This is interesting.
I'm curious how you change this without changing the current workflow of your users.
Always the big challenge.
-
Changing the flow to something like SharePoint or NextCloud might make these requests a lot easier, also more modern. Modern, but perhaps not better.
-
Changing flows is often the most efficient thing.
-
@Dashrender said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
This is interesting.
I'm curious how you change this without changing the current workflow of your users.
It is difficult to change the workflow (I guess, here you mean, making folders according to departments to give full access for specific department and read access for others.)
I understand, above changes can resolve most of my problems, but practically for Users and in Users view, it's damn difficult.
This is because :
-
In one project all departments needs to involve, so Project-55 (lets say) folders will be in all department folders, instead of being in One Location, now the data/files for project is scattered in different folders and users will need to navigate to different folders for one project to need to work with.
-
Our users are using XREF (a feature in CAD, you may familiar with), where users will point from CAD file to other to know what changes done by other departments, so if we change the location on existing files will effect other files, which is going to be a big mess for Users and to IT ultimately.
-
Currently all department files for one project is under one Folder, when we make it department wise, there is a lot of moving activity, which should be done with keen observation to avoid any files missing due to long file path (I am sure there will hundreds cases will arise).
-
-
@wirestyle22 said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
I'm not familiar with a product that would allow you to do this in a way that is not extremely time consuming. Interested to see if anyone else does.
What I was believing before posting this thread, there should be huge number of IT folks should be dealing with this kind of scenarios
-
@scottalanmiller said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
@Dashrender said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
This is interesting.
I'm curious how you change this without changing the current workflow of your users.
Always the big challenge.
Yeah, it seems damn big challenge for me.
-
@scottalanmiller said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
Changing flows is often the most efficient thing.
As I mentioned above, it's going to be big headache for if I think about change the workflow. And how would be scenario, if I need to do it for some hundreds of projects (which can give me a risk of missing files etc.). Let's say, I have given keen observation to transfer files etc. later in future, if any file is missing (maybe someone deleted knowingly/unknowingly before transferring files itself ) and there are more chances that I will come to Users mind that I missed or deleted in the process. [ FYI, we don't have any file auditing software to help in this scenario ]
Due to number of reasons at my end, I do not prefer changing Workflow.
-
I'm not sure I see any reason to not handle this with regular NTFS permissions... What am I missing?
Are the files for a given project spread out all over, instead of in one single folder?
-
@openit said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
@wirestyle22 said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
I'm not familiar with a product that would allow you to do this in a way that is not extremely time consuming. Interested to see if anyone else does.
What I was believing before posting this thread, there should be huge number of IT folks should be dealing with this kind of scenarios
I don't know about a huge number, but probably not a small number or even small percentage.
As I said, moving away from the folder structure and to a flat file system and searching for things based on tags would solve this for you - once you setup default permissions for new files created by users (i.e. John in CAD group 1's files will by default have r/w for CAD group 1 users, and read for everyone else, etc), assuming this can even be done.
But CAD files makes this challenging because of their size.
-
@dafyre said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
I'm not sure I see any reason to not handle this with regular NTFS permissions... What am I missing?
Sure, let's assume the following:
\fileserver\share\projects\project-55\cad-files
4 different departments need to write files to this directory, but only those in the same department can change their department's files.
So we have Dept1, Dept2, Dept3, Dept4
How do you automatically create permissions for a file created by a user in Dep1 to be
Dept1 - R/W, Dept2, Dept3, Dept4 - RSame goes for all departments.
-
@openit said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
@Dashrender said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
This is interesting.
I'm curious how you change this without changing the current workflow of your users.
It is difficult to change the workflow (I guess, here you mean, making folders according to departments to give full access for specific department and read access for others.)
I understand, above changes can resolve most of my problems, but practically for Users and in Users view, it's damn difficult.
This is because :
-
In one project all departments needs to involve, so Project-55 (lets say) folders will be in all department folders, instead of being in One Location, now the data/files for project is scattered in different folders and users will need to navigate to different folders for one project to need to work with.
-
Our users are using XREF (a feature in CAD, you may familiar with), where users will point from CAD file to other to know what changes done by other departments, so if we change the location on existing files will effect other files, which is going to be a big mess for Users and to IT ultimately.
XREF is a standard feature across almost all software. Not really relevant to CAD.
- Currently all department files for one project is under one Folder, when we make it department wise, there is a lot of moving activity, which should be done with keen observation to avoid any files missing due to long file path (I am sure there will hundreds cases will arise).
What CAD software is being used? I bet they have a standard tool to manage this.
If not, then what @Dashrender mentioned already.
CAD tends to have groups of files the software needs for each project, not a single file. So trying to manually manage this would be an exercise in futility, at leas the ones I'm familiar with.
-
-
@Dashrender said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
@dafyre said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
I'm not sure I see any reason to not handle this with regular NTFS permissions... What am I missing?
Sure, let's assume the following:
\fileserver\share\projects\project-55\cad-files
4 different departments need to write files to this directory, but only those in the same department can change their department's files.
So we have Dept1, Dept2, Dept3, Dept4
How do you automatically create permissions for a file created by a user in Dep1 to be
Dept1 - R/W, Dept2, Dept3, Dept4 - RSame goes for all departments.
Ah, ok. I gotcha... That makes sense.
-
@dafyre said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
Ah, ok. I gotcha... That makes sense.
I don't know if that can even be done in SharePoint or NextDrive.
-
@Dashrender This doesn't help the OP, but it can definitely be done with SAMBA on Linux.
We do that here, and have to muck around with the department permissions and such from time-to-time.
-
@dafyre said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
@Dashrender This doesn't help the OP, but it can definitely be done with SAMBA on Linux.
We do that here, and have to muck around with the department permissions and such from time-to-time.
I'd love to see a screen shot of how that looks at the share or folder level.
-
OK in talking with @dafyre I have a possible solution, but man, it's what I would consider a horrible solution.
Write a script that runs as frequently as you need it to, like every min, that looks at new files in folders and generates a new permission set for a file based upon the owner of the file.
The script would have to know who is in what group, and then it would give w/r permissions to that group. The default permissions on the folder would need to be Read Only.
But in typing this out, that wouldn't work, because then no one could ever write a file into the folder in the first place.
-
@Dashrender said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
@dafyre said in Looking to have good and easy control over the shared folders [permissions] on File Server (Windows Server 2012).:
@Dashrender This doesn't help the OP, but it can definitely be done with SAMBA on Linux.
We do that here, and have to muck around with the department permissions and such from time-to-time.
I'd love to see a screen shot of how that looks at the share or folder level.
In the /etc/samba/smb.conf file, in our global section, we have
create mask = 0660 directory mask = 0770Adjust permissions accordingly.
For what he wants, it'd likely be something like
create mask = 0650 directory mask = 0770At the share level.
Edit: @Dashrender reminded me of one additional command that is needed to grant the groups appropriate access to groups for a folder.
The
setfaclcommand.
