Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is it possible to set permissions on a folder in Windows (Server 2003 64bit) so that an account can write and modify, but not execute?

If I set modify permissions, windows seems to insist I also set execute permissions.

This seems like a common scenario to me, as a lot of the logging routines I encounter need to be able to rename or move (effectively delete) a log file to archive it. (eg, many programs create foo.log, and after 24 hours rename it to foo-[datestamp].log, and create a new foo.log for the subsequent day).

I know it's not a huge issue, but I'd be a happy bunny if the website accounts never had write and execute permissions on the same folder at the same time.

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Read & Execute is a subset of Modify, so when Modify is allowed Read & Execute is, by definition, also allowed. See this table on Technet for details.

You can set the special permissions individually (and exclude Execute File) with the Advanced Security Settings window (click Advanced on the Security tab).

share|improve this answer

You cannot set "modify" to a folder for a user without having "execute" permission on it for that user... and, as suggested by another answers here, it's not even possible do deny execution preserving modify so the solution may be this:

a Group Policy for Disallowing Execution by default then whitelisting may be the choiche:

Computer Configuration > Policies > Windows Settings > Security Settings > Software Restriction Policies

Set the security level to Disallowed, Allow the paths in which you want that users can execute in "Additional Rules" and you're 90% done.

You'll just add any application paths outside of Program Files that you might need (network locations, etc.).

I also disallow regedit.exe and runas.exe.

If you just want to blacklist you'll set your default level to Unrestricted, then disallow a specific folder... It's not going to be very effective, though.

Also, make sure to whitelist *.lnk or users will find that start menu shortcuts don't work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.