Setting difficult / different permissions on same Share (Windows)

[Scampicfx]

Dear guys,

I didn't expect that I run into problems with this simple issue. But I'm kind of stuck...

Let's imagine, I have one volume and this volume consists of round about 10 folders at top level, in this example 3 folders:
Folder "Pictures"
Folder "Software"
Folder "Admin"

Each Folder has different subfolders. It looks like this:

Every user account (like User A "Sam", User B "Joe", User C "Sandy") may have access to most of the folders! Guests may have no access at all!
- However, there are some folders, which not everyone may have full access to, but only read access.
- And, there are some folders, like "Admin"-folder, which may only be accessed by admins and no other user accounts!

Folders in Detail:
Pictures\: Every user account has read access, but only admin user has write/read/delete access
Pictures\Pictures-of-User A\: Every user account has read access, but only admin + user A has write/read/delete access
Pictures\Pictures-of-User B\: Every user account has read access, but only admin + user B has write/read/delete access
Pictures\Pictures-of-User C\: Every user account has read access, but only admin + user C has write/read/delete access
Software\: Every user account has read access, but only admin user has write/read/delete access
Admin\: No one has read/write/delete access, except admins who may have full access (write/read/delete) to this folder. But no one else!

Shares in Detail:
There should be one share for each top-level folder. In Detail:
- Share "Pictures"
- Share "Software"
- Share "Admin"
- Share for "etc..." folders
I don't want to have additional shares for each subfolder, like "Pictures of User A", subfolder "Pictures of User B", subfolder "Pictures of User C", because this results in too much different shares.

I've found tutorials like https://www.youtube.com/watch?v=PhYkZlbBbwk
However, directly from beginning, the user advices to not use this for production server.

Sometimes I see people who recommend to set the different permissions using windows. Some other tell to make this more in kind of a unix-way.

The question I'm asking: What method should I use for production server? I have no problems configuring different user accounts or groups in FreeNAS. But right now I don't have any glue about which way to choose? What method should I use? Do I need to configure groups? There are many different access level.
Some users may have full access (like admins), some may have limited access like read-only and only write access to their own folders.

Also, I noticed the functionality of "datasets". In my first opinion it sounds like a plan to add a "ZFS dataset" for each toplevel folder, is that correct?

 

[m0nkey_]

https://forums.freenas.org/index.php?resources/freenas-and-samba-smb-permissions-video.8/

 

[zoomzoom]

Windows shares' permissions should be managed on Windows via icacls, or via Advanced Security (Right Click on share -> Advanced Sharing), NOT via FreeNAS.

• BSD/Linux/Mac shares can be managed via FreeNAS, but Windows shares need to be managed on Windows, else files and directories will have extremely screwed up permissions, and once they're screwed up, they stay that way, even if the share is removed. The only way to fix permissions at that point will be substantial time spent with icacls.
  • Advanced Security should be tried first, as icacls gets complicated quite quickly. There are permissions and access rules icacls can configure that the GUI Advanced Security settings cannot, but for your usage, you should be fine with utilizing Advanced Security.
  
  
• The only permissions that should be set via FreeNAS for Windows is user:group ownership
  1. You'll create users and groups on FreeNAS for each user that needs to access the share, with each user receiving their own group
     • If you have multiple users needing to access the same folder (i.e. a "Public" or "Work" directory), you can create a group specific to those users, but each user should still have their own group specific to that user
  2. Then on Windows, you can set access permissions for each user and user's group.

 

[Scampicfx]

Dear m0nkey and zoomzoom,

thanks so much for your quick answers! It helped me a lot! And wow thanks for these videos, I didn't see them before. Man, I like this community so much! :D

Thanks so much! :D