Let's say I've got a setup like this:

DFS1----> vol1
DFS2----> vol2
DFS3----> vol3

So the ONLY thing on VOL-A are DFS junctions

Users map drive to VOL-A

They cannot see ANY junctions (DFS1, DFS2, DFS3) unless I grant them RF rights to the actual root of the VOL-A itself.

But the problem with that is that if a user isn't supposed to see DFS3, they do, but when they click on it, they don't have rights at the target and get a drive is not formatted error or something like that.

Oh, NW 6.5.7, BTW