Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm an IT technician in a school. We're using DC and File server so the teachers uses a domain user by their own name. There are folders from the File server that are shared to the teachers to use, and the question is how to make the teachers accounts can read/edit the files inside the shared folders but not to let them delete any files inside it?

and sometimes if the staff or teachers log in using their domain account, the profile won't load or the shared folders won't be connected/shown in "My Computer". and sometimes a teacher reached me and saying that he can't go inside the shared folder, the computer gives him the error message about "Group Policy Client".

Thanks in advance!!!

server: Windows Server 2008 Standard workstations: Windows XPs and 7s

share|improve this question
Please split multiple questions into multiple posts. – Kyle Smith Mar 16 '12 at 2:17
If they are allowed to edit, they can empty files, wouldn't that be a problem? – johnny Mar 16 '12 at 4:17

This is entirely possible with NTFS rights, but it is far from a standard configuration. We had to do something similar, create drop-boxes: directories where students could copy in files, but couldn't delete them once there, or see any other directories. Doable with some custom work.

The key is understanding how different rights behave when set on files and directories.

To get what you're looking for, create/modify but not delete for files in a given directory:

  • On the directory:
    • The "Create Files" right (icacls: WD), grants the ability to create files.
    • The "List Folder" right (icacls: RD), grants the ability to list files.
  • On files in the directory (set on the directory, but inherited)
    • The "Read Data" right (icacls: RD), grants the ability to read files.
    • The "Write data" right (icacls: WD), grants the ability to edit files.
    • The "Append Data" right (icacls: Ad), grants the ability to modify files (for things like Access databases that actually modify them, not just delete/recreate)

The icacls call to that would look something like:

icacls M:\FacStaff\Physics\ /grant PhysFac:(OI)(CI)(WD)(RD)
icacls M:\FacStaff\Physics\ /grant PhysFac:(IO)(AD)

Only there is one more step. By default Creator/Owner gets a lot more rights than you'd like. So you have to modify that too:

icacls M:\FacStaff\Physics\ /grant *S-1-3-0:(oi)(ci)(rd)(wd)

That changes the Creater/Owner to be appropriately restrictive.

I must caution, though. Most Office file-formats do a delete-createNewFile process when anyone hits Save. Directories where users can't delete are not that useful for general office work.

share|improve this answer
+1 - Odds are good that the OP really doesn't want this behavior, but that should do it. As soon as somebody tries to save a Microsoft Word or Excel file there they'll be unhappy with the behavior. – Evan Anderson Mar 16 '12 at 2:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.