I have a situation in which several departments need to be able to create files in the same folder. I want users in all departments to be able to read any file in the folder, but I want to restrict modify access to the members of the same department as the user who created a file. For instance, if Bob from Sales creates a file, I want everyone else in Sales to be able to edit the file, but users outside Sales should have only read access. Any tips?
For the setup you desire, use the Creator Group security principal and make each user's department group the primary group. Windows allows a user to belong to many groups, one of which is the user's primary group. You can set the user's primary group in the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in by opening the user's properties window, selecting the Member Of tab, selecting the desired group, and clicking Set Primary Group. In the example that Figure 1 shows, I've set Sales as Bob's primary group.
Then, add two entries in the permissions of the shared folder. First, add an entry that grants all users Read access by using a group such as Domain Users. Second, grant Creator Group modify access.
Whenever a user creates a new file, Windows copies the permission from the parent folder to the new file. When Windows encounters an access control entry (ACE) in which the subject is Creator Group, it replaces Creator-Group with the primary group of the user who created the file. In your case, if Bob creates a file, Domain Users will have read access and Sales will have modify access.
