---
title: Configuring Folder Types
slug: configuring-folder-types
createdAt: 2025-06-11T20:26:20.405Z
---

## Overview

The **FolderTemplate** parameter in Activate stores templates for the various folder types that users can create via Activate, it comes with 5 default types detailed below and can be extended or modified to suit customer requirements. This parameter can be found at `//Resources/Folders` in Activate Studio.

## Configuring Folder Access Rights in Templates

The `<rights>` element in the folder configuration XML defines how permissions are applied to folders and which groups receive them. This section explains the syntax used in the rights string and how it is interpreted by the system.

### Rights String Syntax

The rights string is a compact format that encodes:

- Access type (list, read, write, full, etc.)
- Inheritance behavior
- Allow or deny
- Target group SID

Each entry in the `<rights>` string is separated by a semicolon (`;`) and follows this pattern:

```text
[modifiers][access];[SID]:[access]
```

### Modifiers and Their Effects

| Modifier     | Description                                                        |
| ------------ | ------------------------------------------------------------------ |
| `-` (prefix) | Sets `AceFlags = NONE` — disables inheritance entirely.            |
| `-folders`   | Sets `AceFlags = CONTAINER_INHERIT_ACE` — applies to folders only. |
| `-files`     | Sets `AceFlags = CONTAINER_INHERIT_ACE` (same as `-folders`).      |
| `-deny`      | Sets `bAllow = false` — creates a deny ACE instead of allow.       |

### Access Characters

| Character | Grants Access To…                                                                                                    |
| --------- | -------------------------------------------------------------------------------------------------------------------- |
| `l`       | List access (`FILE_LIST_DIRECTORY` or similar)                                                                       |
| `r`       | Read (`FILE_GENERIC_READ` + `FILE_EXECUTE`)                                                                          |
| `w`       | Write (`FILE_GENERIC_WRITE` + `FILE_EXECUTE`)                                                                        |
| `c`       | Change (read + write + execute + delete)                                                                             |
| `f`       | Full control (`FILE_ALL_ACCESS`)                                                                                     |
| `d`       | Delete only (`DELETE`)                                                                                               |
| `0x...`   | Hexadecimal access mask (overrides character-based access). This is an advanced method for more complex permissions. |

### Special Case: Disabling Inheritance with `-`

If the rights string **starts with a hyphen (**`-`**)**, it explicitly disables all inheritance by setting `AceFlags = NONE`. This is useful when you want the ACE to apply **only to the current folder**, not to any subfolders or files.

### Example

```text
<rights>-r;%=//Groups/0/Sid/SidString%:r</rights>
```

This means:

- **No inheritance**: The ACE applies only to the current folder.
- **Read access**: Granted to the group identified by the SID.
- **Allow ACE**: Because `-deny` is not present.

### Example Breakdown

```text
<rights>-folders-r;%=//Groups/0/Sid/SidString%:r</rights>
```

- `-folders` → Apply to folders only
- `r` → Read access
- **SID** → Target group
- **Result**: Read-only access to folders (not files)

## Folder Types Explained

Each `<folder>` element defines a **template** for creating a folder with specific access control settings. These templates include:

- **Display Info**: Title, description, and icon for UI representation.
- **Template Logic**:
  - `<rights>`: Defines access control entries (ACEs) using SIDs (Security Identifiers).
  - `<listAccess>`: Controls visibility of the folder in listings.
  - `<groups>`: Specifies AD groups to be created and linked to the folder.

### Folder Types

| Folder Name             | Description                                                             | Groups Created  | Rights Summary |
| ----------------------- | ----------------------------------------------------------------------- | --------------- | -------------- |
| **NoSecurity**          | Inherits access from parent folder.                                     | None            | Inherit only   |
| **PrivateAndPublished** | Creates read and write groups. Read-only and full control access split. | 2 (read, write) | Read + Change  |
| **Private**             | Only users in the new group have access. Others are denied.             | 1 (write)       | Change only    |
| **Published**           | Users in the group get read-only access. Inherits parent access.        | 1 (read)        | Read only      |
| **Common**              | Users in the group get full access. Inherits parent access.             | 1 (write)       | Change         |

## Default Folder Types

### NoSecurity

```text
<folder name="NoSecurity">
  <display>
    <title>No Additional Security</title>
    <description>Anyone with access to the parent Folder will be granted the same access to this Folder.</description>
    <image>folder lg</image>
  </display>
  <template>
  </template>
</folder>
```

### PrivateAndPublished

```text
<folder name="PrivateAndPublished">
  <display>
    <title>Published and Private Folder</title>
    <description>This folder can be used to give some users read access and some users write access.</description>
    <image>folder+share lg</image>
  </display>
  <template>
    <rights>-all;%=//Folder/FolderDefaults/folder/standardRights%;%=//Groups/0/Sid/SidString%:r;%=//Groups/1/Sid/SidString%:C</rights>
    <listAccess>=//Folder/FolderDefaults/folder/listAccess</listAccess>
    <groups>
      <group>
        <parentOU>=//Folder/GroupOU/OU</parentOU>
        <name>%=//Folder/FolderDefaults/group/read%</name>
        <description>=//Folder/UncPath</description>
        <type>%=//Folder/FolderDefaults/group/type%</type>
      </group>
      <group>
        <parentOU>=//Folder/GroupOU/OU</parentOU>
        <name>%=//Folder/FolderDefaults/group/write%</name>
        <description>=//Folder/UncPath</description>
        <type>%=//Folder/FolderDefaults/group/type%</type>
      </group>
    </groups>
  </template>
</folder>
```

### Private

```text
<folder name="Private">
  <display>
    <title>Private Folder</title>
    <description>Users in the new group will have full access to this folder.<BR>All other users (including users with access to the parent folder) will NOT be able to access this folder.</description>
    <image>folder+lock lg</image>
  </display>
  <template>
    <rights>-all;%=//Folder/FolderDefaults/folder/standardRights%;%=//Groups/0/Sid/SidString%:c</rights>
    <listAccess>=//Folder/FolderDefaults/folder/listAccess</listAccess>
    <groups>
      <group>
        <parentOU>=//Folder/GroupOU/OU</parentOU>
        <name>%=//Folder/FolderDefaults/group/write%</name>
        <description>=//Folder/UncPath</description>
        <type>=//Folder/FolderDefaults/group/type</type>
      </group>
    </groups>
  </template>
</folder>
```

### Published

```text
<folder name="Published">
  <display>
    <title>Published Folder</title>
    <description>Users in the new group will be granted read-only access to this folder.<BR>Anyone with access to the Parent folder will be granted the same access to this folder.</description>
    <image>folder+tick lg</image>
  </display>
  <template>
    <rights>%=//Folder/FolderDefaults/folder/standardRights%;%=//Groups/0/Sid/SidString%:r</rights>
    <listAccess>=//Folder/FolderDefaults/folder/listAccess</listAccess>
    <groups>
      <group>
        <parentOU>=//Folder/GroupOU/OU</parentOU>
        <name>%=//Folder/FolderDefaults/group/read%</name>
        <description>=//Folder/UncPath</description>
        <type>=//Folder/FolderDefaults/group/type</type>
      </group>
    </groups>
  </template>
</folder>
```

### Common

```text
<folder name="Common">
  <display>
    <title>Common Folder</title>
    <description>Users in the new group will have full access to this folder.<BR>All users from the parent folder will still have access this folder.</description>
    <image>folder+ok lg</image>
  </display>
  <template>
    <rights>%=//Folder/FolderDefaults/folder/standardRights%;%=//Groups/0/Sid/SidString%:c</rights>
    <listAccess>=//Folder/FolderDefaults/folder/listAccess</listAccess>
    <groups>
      <group>
        <parentOU>=//Folder/GroupOU/OU</parentOU>
        <name>%=//Folder/FolderDefaults/group/write%</name>
        <description>=//Folder/UncPath</description>
        <type>=//Folder/FolderDefaults/group/type</type>
      </group>
    </groups>
  </template>
</folder>
```