samba - Nov 2013 - Windows ACLs (non samba)

Hi all,

I'm facing a Windows relative problem, maybe you can help, else please 
disregard, this is out of Samba scope.

Bash script creates each day a folder in share with correct ACLs (thanks 
to samba-tool ntacl set) that prohibits anyone except Administrators 
group to modify/delete, Authentified Users can browse/read.
In this new folder (named 2011-11-06), 3 subfolders are created with 
correct ACLs:
morning midday evening
Only a specific group (named : news) can modify the subfolders contents 
(Administrators too).
Authtified Users can browse/read.

All works as expected, but :
I would like group 'news', not to be able to create subfolders in 
'morning', 'midday' ou 'evening'.

Windows ACLs groups 'create folder/append data' in the same rule, so I 
can't refuse 'create folder' if I want 'appen data' (modify
files).

I feel it's really a Windows problem, but I'd accept any idea.
Right now, I think to write a daemon that checks if a subfolder is 
created and deletes it.

Thanks in advance for your time.
Nicolas

On Wed, 2013-11-06 at 11:07 +1100, me at electronico.nc
wrote:
> Windows ACLs groups 'create folder/append data' in the same rule,
so I
> can't refuse 'create folder' if I want 'appen data'
(modify files).
The trick is to create two ACL entries:
One with 'create folder/append data' that inherits only to subfolders
and one without 'create folder/append data' that inherits to files.
The entries that inherit to files will also inherit to subfolders but
will not apply to the folders.

Cheers,
Alexander