Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Windows Server 2003 machine. All users are administrators.

I have a folder c:\projects. I'd like to make the folder non-deletable and non-renameable (even to administrators). However, administrators should have full control over existing folders and files inside of this folder as well as any new files or folders created inside this folder or any subfolders.

How can I achieve this?

EDIT: I'm not talking about making it "impossible" for administrators to edit. It's fine if they want to take ownership. I'm talking about preventing the folder from being changed accidentally in everyday use.

share|improve this question

2 Answers

up vote 1 down vote

You can't, really. "Administrators" can always take ownership and change permissions on all filesystem objects.

I'm also not seeing the "Delete" permission applied to "This folder only" working properly (under Windows XP Pro SP3 and Windows Server 2003 SP2, at least) working as I'd expect / want them to work, either.

I think you're fighting a losing battle.

share|improve this answer
The server is only accessed by a handful of administrator level people who need complete access to the entire system. – User Jul 28 '10 at 20:27
up vote 0 down vote

Ok, so you're not worried about Administrators legitimately and intentionally changing permissions or ownership on subfolders and files, but only worried about the "accidental" deletion or renaming of the parent folder?

If so, then add (or modify) 2 ACE's on the parent folder for the Administrators group:

  1. Administrators: Permissions = READ & EXECUTE; Apply onto = This folder only

  2. Administrators: Permissions = FULL; Apply onto = Subfolders and files only

share|improve this answer
You're aware that this prevents "Administrators" from creating subfolders or files in the top-level folder, aren't you? – Evan Anderson Jul 28 '10 at 21:24
Hmm... my bad. I guess they probably will need to create new files and folders. – joeqwerty Jul 28 '10 at 22:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.