Best practice to restrict permissions on newly created folders?

Question

I've got a script that the user runs which creates a group of sub-folders in the chosen directory. Obviously the newly created folders inherit the permissions of the parent directory. I need one folder in that newly created group to have a single different ACL to restrict one specific user from access.

Is there a way to automate this at the creation of the folder? Or is there a better way to deal with this?

So, to clarify: Imagine a folder path like the following: E:\datastore\marcstone bids\7501-8000\7501 some high school project\management documents

See how the second to last directory is a project name? There are literally hundreds of these, inside of which are the same 10 folders. I want all my users to have access to all those folders, except I need to restrict access to one folder for one user.

Unless I'm missing something, no matter how I set up the parent directory permissions (which will get inherited) I will still need to either remove or add a permission from/to that one folder after it's created. This just feels clumsy and complicated. Am I missing something? Is there another way to do this?

Answer 1

The best practice is to make that one user a member of a different group, and grant that group

• traverse permission on the parent folder (non-inheritable), and
• access on that one child folder (inheritable).

If you only want to deny access to one subfolder, it's even simpler: just add a deny ACE for that group on the respective folder.

Nothing clumsy or complicated about it.