Sitecore Media Library Permissions

Question

Our current instance of Sitecore (8.2) is set up with one main website and multiple sub-websites. Each sub-website has their own set of users/roles and a folder in the media library. Initially every role has full access to every folder and you must deny certain access (write, create, rename, and delete) manually for each folder for each role. For every new folder that is put into the media library, you must then go back to all the current/older roles and update their permissions (denying the write, create, rename, and delete access) manually for each new folder.

We are looking to simplify this solution so each current/older role is denied permissions automatically for each new folder added and each new role is automatically denied permissions to all current/older folders.

How would this be possible?

Answer 1

Try to avoid denying access, it's not a good practice.

In a clean Sitecore install the role "Sitecore Client Authoring" is given modify permissions on all descendants of the media library root folder. If you remove this role from the root folder, all users will be denied access to all sub folders. Now you can add modify permissions (write, create, rename and delete) for each folder, only for those roles who need access to it.