zyonchaos

Now I apologise now for the incoming wall of text, but I am completely confuzzled (also my first post yay me).

To begin with I am one of the network admins for a NT4 Domain running win 2000 wrkstns, we have approx 1000 user accounts, all members of various local groups, and thats just here we have over 150 sites worldwide that are in the process of beginning this headache.
Our old way of filing on the network was easy. Each local group would have a folder eg. Admin would have a folder called Admin, Accounts would have a folder called Accounts. Within those folders they could create any folder/file they wanted.
Now due to the Freedom of Information act and the Data Prevention Act, we have got to completely re-file and re-organise our entire network (again YAY ME).
So before on the old system if they were the member of a group and that group had permissions to those folders they got it. Simple really, but not as secure as the boss' wanted it.

So now onto the new system, we have two halves of a shared drive. One called Working and One called Registry. The theory is that these two folder structures will mirror each other with the Registry folder being Read Only for everybody (except admins) and the Working folder being Read Only for everybody (except for admins and a few Ltd folders with things such as personnell files). The reason behind the mirroring is that as people are working on their files they will no where to file them when they are finished (genius aint it). This is being employed across all of our sites which means we only have a loose guideline on how its going to work and so everyone is making it up as they go.

Now the problem I have been landed with (I'm at the bottom of a steep brown smelling heap) is although they want everyone to have read access across the entirety of the Working drive, the people who's work it is need to be able to modify it simple until they throw in the caveat of they dont want them to be able to create folders, so they gave us a work instruction that goes like this:-

-Standard permissions eg
Administrators - Full Control
Domain Users - List folder contents and Read
Accounts - Modify

Now go into advanced, click on Add, select the group you want eg Accounts
In the Apply onto box select 'This folder and subfolders'
select the 'Deny' column for 'Create Folders/Append data'
Click Ok, Click Apply, Click Yes on the security Warning, Click OK, then Apply and finally Ok.

Apparently doing all of that and someone has typed this up with screenshots and everything turning all that into about 8 pages (winner) and it will stop people from being able to create folders and it does SUCCESS however it stops them from doing anything else with their own files because of the Append data tag that goes with the create folders.

Can anyone think of a solution that can get around this whilst still having the desired affect. One final problem this has to be able to be done in Win 2000 or on the server without the need of any 3rd party software.

If anyone has survived this long reading all of this and I did apologise at the beginning for the wall of text, if you can help it would be much appreciated. As since logging in this morning I already have found two solutions to problems I am having at home with my comps there so cheers.

zyonchaos

Can nobody help with this. Sorry for double posting. Its just I have tried everything and my Boss is wanting this to work but doesnt seem to want to here the phrase "it cant be done" off anyone.

I wont like it but I will resort to begging if I have to lol

blah789

If you ask someone to move this thread to the server section, you might get more replies.
http://www.techsupportforum.com/micr...0-2003-server/
(Or repost there if necessary - I don't condone cross-posting, but if no one answers your post, I guess that's your only resort)

zyonchaos

Cheers blah,

Have reposted now. Thanks for the help

zy