Regarding Isilon Sub-Folder share permission

set the NTFS-ACLs on /ifs/data/Projects in a way that usera and userb are able to acces it. (authenticated users: read)

to increase security you could enable ABE to prevent them from viewing folders they do not have permissions for.

Edit:

im not quite sure, but isn't it possible under Windows to access a subfolder without haveing permissions on the topfolder, as long as you specify the complete path to the directory where you have the permissions? this means a direct map of \\isiloncluster\smb1\engg should work even if there are no NTFS permissions on /ifs/data/projects. A mapping of \\isiloncluster\smb1 would not work in this case.

remember that most restrictive permission wins, if you have read only on the share and full on folder permissions ..user will have read only permission.

Dear All,

      Thanks for your valuable inputs. Finally I did work around and fix the issue. However it could be fit for mid-range environment. The fix is as follows:-

1. Create the folder under file system explorer "/ifs/data/Prod"

2. Create sub-folder under "/ifs/data/Prod/project" and "/ifs/data/Prod/dev"

3. Create SMB export "prod" with the export path "/ifs/data/Prod"

4. Login as root to the ision by accessing this "prod" share -  \\isiloncluster\ifs\

5. Go to properties of "/ifs/data/Prod" folder, go to security tab and add the customer admin user with full permission and other end users [usera, userb]. Then click "Advanced" tab , Select "Change permission", Select/Edit the user "usera" with "Traverse" permission in "Allow" and the rest all permission in "Deny" column, also Keep "Apply to" should be "This Folder, Sub Folder and Files" , but assign full permission for them in the subfolder "/ifs/data/Prod/project" and "/ifs/data/Prod/dev" respectively. To achieve the subfolder full permission for usera & user b go to properties of "/fis/data/Prod/project" and "Advanced" --> "Change Permission" ---> Add "usera" and set full permission in the "Allow" column as required.

6. Here I took usera as an example, in customer environment it could be "group" permission but the procedure is same.

7. Now the challenge is here as long as the business unit grows it is very difficult to follow the same however if the BU is medium size and you are using "group" permission to manage users then this could help you.

          Thanking to all and if any one need more information on this please let me know. I have screen shot for the above mentioned but don't know how to upload here.

     thanking a

what you did (in my words) is to give them proper NTFS rights to access /ifs/data/Prod.

just my 5 Cent:

- never use user-accounts in NTFS Permissions. always use groups

--> if a user leaves, you will have remaining "lost" SIDs

--> if the Access for the Group is not needed anymore you normally delete the whole structure (if properly diverted)

--> if you have to give an additional user permissions you can just join him to the Group and don't have to set permissions to the whole Folder-structure.

- where applicable use wellknown SIDs like "authenticated users" since this abstacts even more complexity. Use ABE to make the things more secure and stop irritating the user.

- only use deny permissions if you want to deny Access to a user(Group) that has Access on topstructures, and you are unable to stop inheritance on that Folder.

otherwise Troubleshooting the structure gets fricking complicated.

and last but not least:

think about a role/rightsmanagement BEFORE you build the structure.

very convoluted to say the least, you are making it too complicated than it should be.

/ifs/data/prod - give traverse permissions to either authenticated users or some other group that can be easily modified to add other groups

/ifs/data/prod/development - remove inheritance and set permissions as you see fit

/ifs/data/prod/projects - remove inheritance and set permissions as you see fit

take advantage of ABE as sluetze mentioned before.