This is entirely possible with NTFS rights, but it is far from a standard configuration. We had to do something similar, create drop-boxes: directories where students could copy in files, but couldn't delete them once there, or see any other directories. Doable with some custom work.
The key is understanding how different rights behave when set on files and directories.
To get what you're looking for, create/modify but not delete for files in a given directory:
- On the directory:
- The "Create Files" right (icacls: WD), grants the ability to create files.
- The "List Folder" right (icacls: RD), grants the ability to list files.
- On files in the directory (set on the directory, but inherited)
- The "Read Data" right (icacls: RD), grants the ability to read files.
- The "Write data" right (icacls: WD), grants the ability to edit files.
- The "Append Data" right (icacls: Ad), grants the ability to modify files (for things like Access databases that actually modify them, not just delete/recreate)
The icacls call to that would look something like:
icacls M:\FacStaff\Physics\ /grant PhysFac:(OI)(CI)(WD)(RD)
icacls M:\FacStaff\Physics\ /grant PhysFac:(IO)(AD)
Only there is one more step. By default Creator/Owner gets a lot more rights than you'd like. So you have to modify that too:
icacls M:\FacStaff\Physics\ /grant *S-1-3-0:(oi)(ci)(rd)(wd)
That changes the Creater/Owner to be appropriately restrictive.
I must caution, though. Most Office file-formats do a delete-createNewFile process when anyone hits Save. Directories where users can't delete are not that useful for general office work.