Hi. I have a 2000 file server with a share that looks like this: SharedFiles <-this is root of share >Folder1 >Folder2 >Folder3 Files (various Word docs and such) What I want to do is have a group be able to only access Folder1 and not be able to open any of the files in the root of the share or in the subfolders. How can I do this? I tried just giving List Folder Contents on SharedFiles to the group I want to control and then gave them everything except Full Control on Folder1. Yet, they can still access files in the root of the share and within subfolders on the share. Any help please?

rule one: don't put files in the share root unless you want to assign and deny BY FILE [which by the way once someone edits and saves wipes out the explicite deny rights] rule two: if you don't want a group having access to a folder assign that group and then deny access. Give a person a fish, they eat for a day. Suggest they internet search and they learn a skill for a lifetime.

So are you saying that there is no way I can block access to those files unless I go to EACH file and specifically deny access? And there is no way I can block access to every other subfolder without going to each subfolder individually??

Well I thought I got it to do what I wanted. I went into the SharedFiles advanced permissions and selected apply to Subfolders and Files Only. Then I denied everything. Now it seemed to do what I wanted it to do, but I just tested trying to delete a file in the root of the share and I am able to delete it even though I explicitly denied the Delete and Delete Subfolders and Files permission! What is going on? Am I missing something? Please help. Thanks.

Key word is inheritance http://www.mcmcse.com/microsoft/guides/ntfs_and_share_permissions.shtml Give a person a fish, they eat for a day. Suggest they internet search and they learn a skill for a lifetime.

Huh? What about inheritance? The root of the share is not set to inherit permissions from its parent. All of the subfolders are except Folder1 which is the folder I want this group to be able to access.

Try this: Traverse File Permissions Larry Today seems like a good day to chew through the restraints.