Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to prevent folders moves, really folder delete in NTFS parlance, for series of folders within a network share.

So let's say I have: FolderA, FolderB, FolderC. Each folder has various files and subfolders. I want the Domain Users group to have modify access to all files and folders beneath FolderA, FolderB, and FolderC. However I don't want them to be able to delete these three top level folders.

The issue we are having right now is people keep accidentally dragging one top level folder into another.

I've tried used advanced NTFS permissions to deny domain users delete access to these top level folders, and set the permissions to apply to "This folder only", however it seems to only affect sub-folders, and not the top level.

Platform is Server 2008 Standard.

Thanks in advance.

share|improve this question
    
Have you tried doing that to the parent folder of the FolderA, B and C? –  Nixphoe Aug 10 '11 at 20:16
1  
A folder move (within the same drive) is not a "folder delete in NTFS parlance", it's a rename. –  John Gardeniers Aug 10 '11 at 21:41
add comment

3 Answers

"Deny" is usually the wrong tool for the job and is a sign that your permission hierarchy is upside-down.

Rather than denying permissions, grant "Domain Users" the "List Folder Contents" permission on "This Folder Only" and "Modify" on "Subfolders and Files". This will allow them to list the contents of the top level folder but will not allow them to delete it. They will still be able to modify subfolders and files within the top level folder and subfolders. This assumes that "Domain Users" isn't inheriting excessive rights from a parent folder, though. If they are then you're going to need to stop permission inheritance (which makes me cry inside).

share|improve this answer
    
Sigh, every time inherit is disabled 6 months later someone in a new group has rights issues. But I don't see any way around it. –  Mark Henderson Aug 10 '11 at 20:58
    
@Mark Henderson: Novell's filesystem had it right with "inherited rights filters". I never did like much else about Novell products (and have a particular distaste for "FIRE PHASERS" and anyone who would use it) but I'd love it if NTFS had that kind of functionality. –  Evan Anderson Aug 10 '11 at 21:03
add comment
  1. Set the following ACEs on the top level folders for domain users, using the Advanced permissions dialogue:

    • This Folder, Subfolder, and files -> Traverse, List, Read Attributes, Create Files, Write Data, Create Folder, Append Data, and Read Permissions
    • Subfolders and files -> Modify (everything but Full control and Take/Change ownership)

  2. In each top level folder, create a placeholder file. From a command prompt:

    • cd /d "Z:\[TopLevelFolder]"
    • notepad " placeholder.txt"

    • NB: Make sure there is a space between the opening quote and placeholder.txt. When notepad opens, click yes to create a new file then close notepad (saving if prompted).

  3. Set the ACL on placeholder.txt to Read Only for the domain users group. This needs to be done through the Advanced NTFS permissions dialogue; inheritance will need to be removed and the entry explicitly set for this file.

  4. Optional: set the Hidden attribute on placeholder.txt to prevent Explorer - in its default state - from displaying to the user.

Notes.

  • Instructions built using guidance on this blog
  • If a top level folder (e.g. folderA) is dragged and dropped into another top level folder (e.g. folderB) then folderB will contain a copy of folderA (named folderA) but will be empty. FolderA will remain untouched in the root of the drive.
share|improve this answer
add comment

Under advanced permissions you need to grant "Delete Sub-folders and Files" permissions on your top level folders to "Domain Users".

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.