how can I give my users R/W and Create access but not Move/Delete?

Question

I have a lot of network shared folders that everyone on the domain has access to through a group. They have "Contributor" permission level. We have a windows server domain.

I have issues quite frequently of folders going missing. Most of the time it's because someone drags it inside of another folder. Other times people just accidentally delete.

This causes Mozy to sometimes drop part of my backup set if I don't catch the move within 14 days.

I'm trying to find a good method of keeping this from happening. Posting here hoping for some good solutions.

We don't use sharepoint or any sort of document management system. And while I could strip away all access except for read and then force the users to submit new documents through a special "approval" group this method seems to create more work. I need something between what I currently have and this.

Any ideas?

Answer 1

Set the restricted deletion flag or stick bit on the directories in question. This will prevent moving or deleting them unless a user is the owner of the directory.

Then set the directories to be owned by the admin, not any individual user. They will still be able to create new folders that they will own, which they will have permission to delete.