Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an AD security group of accounts that I need to have access to some folders. They need to be able to traverse these folders into sub-folders, where they will be writing files. But these accounts cannot have the ability to read the files, alter the files, fiddle with the attributes, or delete the files the sub folders contain.

Is there a way to configure that? The file server is 2008r2.

share|improve this question
So, create but no modify, create but no read, create but no delete? – RobW Sep 28 '11 at 0:23
You can definitely achieve this, but you need to sit down and read up on the different NTFS permissions (Specifically those that appear in the "Advanced" settings page so that you achieve exactly what you want. You may need to turn off inheritance, too. – Dan Sep 28 '11 at 8:08

Its actually quite easy to achive this.

We have this where I where so student can write files but not modify it.

You can use basic right administration tab, no need to use the advance mode.

Rights required :

--Write and List folder contents

This way our student can create files/folder and copy them in the folder without them being able to rewrite or read files.

With this solution, user can create folders but wont be able to rename them. They will need to create the folder where they have rights to change name then copy/drag n drop in your folder with specials rights.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.