On our file server, we have a directory, lets say S:\, that is shared out as \\server\share. This share is mounted (mapped) by our app server, as say M:\ = \\server\share We use a particular windows user, batchUser, to run batch processes on as application server. These processes create\modify\etc. files in this directory (or its subdirectories), and so this user ID has the appropriate write permissions.

On the server is a directory tree containing, among other thing, the directories S:\rootDir1\subDir and S:\rootDir2. Some of our processes write to this directory. A couple of our processes need to read from this directory, but must be prevented at all costs from writing to this directory. Furthermore, these read-only processes must also run as the same user ID.

For various other reasons, the read-only processes access this subDir via a junction that is set up on the file server. That is, on the file server, there is a junction S:\rootDir2\subDir => S:\rootDir1\subDir. Thus, on our appserver, the applications see two directories, M:\rootDir1\subDir and M:\rootDir2\subDir.

We need to ensure that the RO processes do NOT modify or write to the M:\rootDir2\subdir directory in any manner. Is there any way to make the junction on the file server a "read-only" junction?

One issue with this is that we need to preserve the directory tree structure for the RO processes. That is, the RO processes must see the directory tree M:\rootDir2 as we have it and be able to write to all other directories within this tree except for the M:\rootDir2\subdir junction.

Lastly, this must be done with junctions (that are processed on the file server side) and not symlinks that are processed on the app server side. (This is a requirement because of other issues, such as accessing the the directories via different interface cards, i.e. different networks.)

On our file server, we have a directory, let’s say S:\, that is shared out as \\server\share. This share is mounted (mapped) by our application server, as, say, M:\ = \\server\share.

We use a particular Windows user, batchUser, to run batch processes on as application server. These processes create\modify\etc. files in this directory (or its subdirectories), and so this user ID has the appropriate write permissions.

On the server is a directory tree containing, among other thing, the directories S:\rootDir1\subDir and S:\rootDir2. Some of our processes write to this directory. A couple of our processes need to read from this directory, but they must be prevented at all costs from writing to this directory. Furthermore, these read-only processes must also run as the same user ID.

For various other reasons, the read-only processes access this subDir via a junction that is set up on the file server. That is, on the file server, there is a junction S:\rootDir2\subDir => S:\rootDir1\subDir. Thus, on our application server, the applications see two directories, M:\rootDir1\subDir and M:\rootDir2\subDir.

We need to ensure that the read-only processes do not modify or write to the M:\rootDir2\subdir directory in any manner. Is there any way to make the junction on the file server a "read-only" junction?

One issue with this is that we need to preserve the directory tree structure for the read-only processes. That is, the read-only processes must see the directory tree M:\rootDir2 as we have it and be able to write to all other directories within this tree except for the M:\rootDir2\subdir junction.

Lastly, this must be done with junctions (that are processed on the file server side) and not symlinks that are processed on the app server side. (This is a requirement because of other issues, such as accessing the the directories via different interface cards, i.e. different networks.)