Needing to change a folders NTFS permissions for a group from Modify to Read at a specific time. What's the best/fastest way to do this?
So at a specific time I'm going to need to change a groups access to a folder (with a lot of content) from Modify to Read only.
Am I right in thinking that if I just change the groups permission to that folder from Modify to Read it's going to take a long time? What's the best way to do tackle this?
Posted Nov 4, 2022, 1:34 AM UTC
510
The best way in my opinion when it comes to folder level permissions is to set up permission groups on the folders and add role groups to those groups so users are never directly assigned. You might have a "Folder1.fullaccess" group and a "Folder1.readaccess" group. Instead of adding users to those groups, you create a role group which has users and/or user security groups in them. You then apply the appropriate folder level permission to that group by making that group a member of the appropriate folder permission group. Through nested group permissions, the users then get the level of access that they need.
If you have time, go ahead and adjust all this now. Create a full access/modify group and a read group and add them with the appropriate permissions to the folder's NTFS permissions. After that is done, add your group with all of your users or user groups to the appropriate permission group at this time and remove the user group from the folder's NTFS permissions. When you need to flip permissions, all you have to do is remove the user/role from one folder permission group and add them to the other.
This way is dependent on ticket lifetime though. You could not guarantee everyone will have read-only immediately after the switch, especially for already active and authenticated sessions.
Is there a quickfire way to just cut modify permissions and apply read-only permissions?
Can you create a Share for them to use, or does accsss have to be via the path they currently use?
Yeah the path needs to stay the same. Content is being migrated to SharePoint, so once the migration starts I wanted to set their access to the file share to read-only so they don't keep working from the file share.