Junction Points and ACL 'protection' - how?

I've set up a couple of Junction Points (reparse points), in order to gain more
space on my C: drive, redirecting the Documents and Settings folder and the
Program Files folder.

Microsoft highly recommends using an ACL to prevent these Junction Points
from being inadvertently deleted from Explorer, etc.

How can I protect only the Junction Point from modification/deletion, using
ACL permissions? Setting the Write or Modify permissions on the Junction Point
also prevents writing and modifying of any 'children' of the junction point, even
if the target-folder's permissions are set to allow writing and modifying.

I've set the security settings via the junction point's Properties, changing the
permissions, removing (unchecking) the 'Modify' and the 'Write' permissions,
for 'Everyone'. I then looked at the 'target' folder to see if those specific
permissions were affected on the target folders, and they weren't.

With the permissions set this way however, I can only write/make changes to
the target folder's files if I go directly to the target-folder, and not if I access it via
the junction point. In other words, setting the junction point's permissions to not
allow Writing or Modifying of the Junction Point also sets the permissions for the
child of the junction point when accessed through the junction point, but when 'going
around' the junction point, accessing the target-folder directly, the changed permissions
are not in force.

What am I missing? What's the right way to protect only the junction-point so it
can't be deleted or renamed (even by an administrator with a failing memory).

Thanks for any input on this, I can use all the help I can get.

--
Cwebb
(if emailing reply, use this address:
blinds-94050 at mypacks net

After some trial and error, it looks as though Win2k (SP4) by default, is
protecting _folders_ that are accessed through the Junction Point, but
not the Junction Point itself.... I can delete the Junction Point through Explorer,
but cannot delete folders that are 'inside' the J.P. However, I _can_ delete
files that are 'inside' the Junction Point.

iow: I've found that I'm unable to delete any folders that I access _through_ the
J.P. using Explorer, although files are fair game, and can be deleted. Yet,
it's no problem deleting these folders with Explorer from the Junction Point's
actual target folder.

I still would like to know how to keep Junction Points safe from errant users...

Anyone know about this?

--
Cwebb
(if emailing reply, use this address:
blinds-94050 at mypacks net

On Wed, 13 Feb 2008 20:09:43 -0500 in Meesage-ID <rp27r3dov2qsedqcrg1vsfebc2j0g3261o.DeleteThis@4ax.com> Cwebb
wrote:

>I've set up a couple of Junction Points (reparse points), in order to gain more
>space on my C: drive, redirecting the Documents and Settings folder and the
>Program Files folder.
>
>Microsoft highly recommends using an ACL to prevent these Junction Points
>from being inadvertently deleted from Explorer, etc.
>
>How can I protect only the Junction Point from modification/deletion, using
>ACL permissions? Setting the Write or Modify permissions on the Junction Point
>also prevents writing and modifying of any 'children' of the junction point, even
>if the target-folder's permissions are set to allow writing and modifying.
>
>I've set the security settings via the junction point's Properties, changing the
>permissions, removing (unchecking) the 'Modify' and the 'Write' permissions,
>for 'Everyone'. I then looked at the 'target' folder to see if those specific
>permissions were affected on the target folders, and they weren't.
>
>With the permissions set this way however, I can only write/make changes to
>the target folder's files if I go directly to the target-folder, and not if I access it via
>the junction point. In other words, setting the junction point's permissions to not
>allow Writing or Modifying of the Junction Point also sets the permissions for the
>child of the junction point when accessed through the junction point, but when 'going
>around' the junction point, accessing the target-folder directly, the changed permissions
>are not in force.
>
>What am I missing? What's the right way to protect only the junction-point so it
>can't be deleted or renamed (even by an administrator with a failing memory).
>
>Thanks for any input on this, I can use all the help I can get.