Set ntfs permissions so that a file can be read, but no browsing of the directory

Solution 1:

This should be fairly easy. Enable ABE (access based enumeration) on the share and make sure that you set the NTFS permissions correctly on the files and folders within the share.

http://technet.microsoft.com/en-us/library/dd772681(WS.10).aspx

Alternately, the Bypass traverse checking user right grants the Everyone group (by default) the ability to taverse folders that they don't have NTFS permissions on in order to get to files that they do have NTFS permissions on. Here's what to do:

  1. Grant the Everyone group Change and Read permissions on the Share.

  2. Set the appropriate NTFS permissions on the folders and files within the share.

A user may then access the files directly via

\\servername\sharename\foldername\filename

As long as you have the Share and NTFS permissions set correctly the users will be able to access the appropriate files without being able to browse the contents of the share.

Solution 2:

The problem with your setup (assuming I understand it correctly as "have all files in a single directory") is that a clever client can guess the filenames of other people, and gain access to their data, so it doesn't matter that they can't browse, it only matters that they can pick up any file by name, and that means other client's files.

In other words, obscurity does not imply security, only that it is out of sight, out of mind. Someone with a little imagination will come along and see right through that.

I'd re-think the approach, and possibly isolate each client to a subdirectory that only they have permissions to. You would then be able to isolate the client to that location only by sharing the client's specific directory level upwards...and they could browse all they want, because there is nothing else to see. When they connect/log in, they only get access rights to "their directory"...it won't matter that there are other directories because they don't get access to them (lacking the correct privileges).