Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a folder for employees to scan contracts to. After scanning, they're supposed to rename them according to our conventions so they can be processed further. In response to a recent incident, these folders have had their security locked down (they're granted write, but not modify, permission) and now they are unable to rename the files.

Is there a technical way to accomplish what I'm trying to do? From what I've read, I don't think this is possible.

If not, can you suggest any workarounds? One possibility is to set the name of the file as it's being scanned in. Another is to have a trusted person in management be given sufficient permissions to rename.

share|improve this question
    
Are you sure that one needs delete permissions to rename an object? That sounds strange because why would rename involve a delete? Microsoft's security model is quite a pain, whether it comes to NTFS, or AD or Sharepoint. Complexity seems to be the enemy of security. If delete permissions are required to rename a file, then it seems better to have one dedicated IT person spend a few days to complete the task, than to give all users delete permissions on the files. –  Gustave Feb 15 '13 at 1:09
    
Why don't you write a script that watches for new files (the Windows API provides the means) and then hardlink them outside. Assuming someone goes and removes something from inside the realm they are supposed to be able to write to, they still can't delete the hardlinked "copy" outside ;) –  0xC0000022L Feb 15 '13 at 2:36
add comment

3 Answers 3

up vote 2 down vote accepted

Apparently rename requires the delete permission. Alternatively, could you have the files be renamed before being placed in the required folder?
Another idea - perhaps a batch job could run that would rename files appropriately that could be run as a schedule task on the server with appropriate permissions.

share|improve this answer
    
How does denying delete, and simply not allowing it, differ? –  Bigbio2002 Jul 17 '12 at 16:49
2  
A single Deny overrides all Allows. Use 'Deny' sparingly for this reason. Administrative override still trumps Deny however. –  Chris S Jul 17 '12 at 16:50
    
it would ensure that the specific user/group is not allowed to delete the file. Just in case it would be inheriting delete permissions from a higher folder. –  Paul Ackerman Jul 17 '12 at 16:50
    
Currently, I have all attributes selected, except Full Control, Delete Subfolders/Files, Delete, Change Permissions, and Take Ownership. This allows creation (and modification) of files, but does not allow deleting (and hence renaming). –  Bigbio2002 Jul 17 '12 at 16:53
1  
Note: an Explicit Allow overrides an Inherited Deny. Here's the order of NTFS permissions precedence: Inherited Allow - Inherited Deny - Explicit Allow - Explicit Deny –  joeqwerty Jul 17 '12 at 19:05
show 1 more comment

Let me write my comment up as an answer. You could write a resident PowerShell script that uses (Start-FileSystemWatcher from PowerShellPack) to watch for new files in that particular location and then hardlink those into a location not accessible by the employees. Your biggest concern seems to be that none of the data ever gets removed again, so this would accomplish it, while still providing the Delete ACE needed for renaming. In your "backup" location with the hardlinks you could then keep an index based on the cryptographic has (SHA1 comes to mind) and thus avoid duplicates. Of course the complexity of this can be bumped up further to suit your needs.

Of course such PowerShell script could take over the renaming task itself. Depends on how easy the rules are to automate.

share|improve this answer
add comment

Not only using NTFS file permissions.

You could create a program which runs as a service that is started when the computer starts. Said service runs under an account which is allowed to delete and create files (and thus rename files).

Then you create a small program which performs rename on files by calling the service you wrote. That program could present itself in the explorer context menu when right clicking on a file as "Privileged rename".

share|improve this answer
    
You can absolutely do this with NTFS permissions –  Zypher Jul 17 '12 at 16:51
    
Could you please explain how? Have you actually tested this? –  Deleted Jul 17 '12 at 18:07
    
Creative idea to delegate authority to a custom service, but it's far too complicated for my needs. –  Bigbio2002 Jul 17 '12 at 20:49
    
@Zypher Old as hell, but you are absolutely incorrect on this number. NTFS permissions require that you be granted delete permission in order to rename an object (for some reason). –  HopelessN00b Feb 11 at 16:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.