How to give a user access to only one folder and its contents in a network share?

Question

Active Directory

There is a DFS server on WinServ_2016
There is a shared disk, it contains folders with departments with permissions for access groups in AD, how to give a domain user access to a specific folder in a foreign department so that he does not see the rest of the content?

For example: S:\Department_1\Folder_A\Folder_B\Folder_C\ Folder_D
The user must have access only to folder_D and its contents.
How I did it: I added the necessary user to the folder_D security group and he got access to it, but only if you enter the full path to it in the explorer.
And I need it to get there from the S drive, folder_A, etc. and at the same time did not see the contents of associated folders.
I'm sorry for the incorrect explanation, I hope you understand)

How to complete this task?
If there is info to study the operation of folders and network drives, please share.
Thanks to!

Answer 1

Minimum traverse rights (I don’t remember offhand, most likely Traverse Folder / Execute File) for each folder (scope this folder only) plus Access-Based Enumeration included on the ball.
The maximum that he can see is the names of the files in the intermediate folders.

Answer 2

Through a symlink is not an option?

Answer 3

I need it to get there from drive S, folder_A, etc. and at the same time did not see the contents of associated folders.

Within the framework of the ideology of assigning rights to NTFS, you will not find an acceptable solution. In order to "see" a subfolder in a folder, but not "see" the files of this folder, you need to have permissions directly assigned to both the folder and the subfolder, and in the case of a folder, they apply only to this folder. Which means that you will have to use the direct assignment of rights to the folders Department_1, folder_A, folder_B and folder_C. Such an approach is a direct path to the mountain of direct appointments and the resulting mess.
Offhand I see two solutions.
The first is to create a separate DFS node that outputs directly to the target folder. As for me - the most logical solution. The right to the node is given to the group, the user is included in the group - and that's it. If someone else needs to be given the right - it is also in this group. In this case, the folder will be the root, and there is nowhere to "climb" from it.
The second is the output of the user directly to this folder by means of the file system. A shortcut, a symlink... What's bad is that the full path of the folder is displayed to the user, and he can try to "climb higher", with a very logical access error message.

Answer 4

You can place the link somewhere in the directories available to the user. But it is better not to allow the appearance of rights for specific users to specific files - then such noodles from access rights turn out, over time.