I'm just now trying DFS in a test environment. I've got junctions in one place pointing to 3 different target file systems. Users have trustee rights in subdirectories on one or more of the different target file systems. I want the users to map to the junction host directory and only see junctions where they have rights down a subdirectory path, otherwise the junction (target filesystem 'root') shouldn't show. If this was just a straight mapping to a drive without DFS involved, the users mapping to a parent directory wouldn't see any of its folders under which they have no rights. But to have the junction show up at all it seems I have to set (some) rights on the junction itself whether they have rights down the target path or not. When they do not and click on the junction "folder" there is an ugly operating system error about the drive not being available -- this is what I want to avoid.

Ideas, suggestions, clarifications?