# Make files copied into a folder not executable?

Is there a way to make any files got copied into a folder not executable by any user?

The folder is writable, but nothing inside can be executed directly.

-
Note that regardless of the permissions on the folder, the owner of a file (the person who wrote the file) can explicitly change the permissions on that particular file to make it executable. –  Harry Johnston Sep 26 '12 at 2:46
@Harry Johnston: That's not true. You can remove the "Change Permissions" permission from the folder to prevent that. I just tested this and verified that I was not able to make the change. At work we remove the following permissions for the groups assigned to department folders: Full Control, Traverse Folder/Execute File, Delete, Change Permissions, Take Ownership. –  Starfish Sep 26 '12 at 17:24
@Starfish: the owner of the file can change the permissions regardless of the existing permissions. See technet.microsoft.com/en-us/library/cc783530%28v=WS.10%29.aspx –  Harry Johnston Sep 26 '12 at 20:51
However, there is a workaround: if the permissions on the share are "Change" rather than "Full Control" then you can't change file permissions via that share. –  Harry Johnston Sep 26 '12 at 20:51
@Harry Johnston: Thanks for the link. That's probably why it didn't work when I tested it. I'm accessing the test file via a share and only set Change permissions for the share. –  Starfish Sep 26 '12 at 21:43

Yes, you can remove the execute permissions from the folder by using advanced permissions.

1. Right-click on the folder name and choose "Properties".
2. Click the "Security" tab.
3. Click the "Advanced" button.
4. Click the "Change Permissions..." button.
5. Uncheck "Include inheritable permissions from this object's parent"
6. A window will appear. Click "Add" to keep the existing permissions. You will edit them in the next steps.
7. Add or select the user or group that you want to restrict from executing files. If you are selecting an existing group, click the "Edit..." button.
8. The following window will appear. Uncheck the allow checkbox for "traverse folder / execute file" which I've enclosed in red.

According to the Microsoft Technet entry on permissions for files and folders, the "traverse folder / execute file" permission does the following:

For folders: Traverse Folder allows or denies moving through folders to reach other files or folders, even if the user has no permissions for the traversed folders. (Applies to folders only.) Traverse folder takes effect only when the group or user is not granted the Bypass traverse checking user right in the Group Policy snap-in. (By default, the Everyone group is given the Bypass traverse checking user right.)

For files: Execute File allows or denies running program files. (Applies to files only).

Setting the Traverse Folder permission on a folder does not automatically set the Execute File permission on all files within that folder.

-

This is one of the rare cases where using Deny permissions is actually useful. It may be more convenient to add a deny permission than to change the allow permissions.

You can do this from the command line (on Vista or later) like this:

icacls c:\path\to\my\folder /deny Everyone:(OI)(IO)(X)


You can also do it from the GUI if you prefer. You don't need to turn off "Include inheritable permissions from this object's parent" but I recommend you select the "Apply to files only" option.

-
That's an excellent point. Here's an article that talks about the risks of using Allow versus Deny and how sometimes Allow can take precedence over Deny: windowsecurity.com/articles/… –  Starfish Sep 26 '12 at 2:54

This can be done by carefully crafting the permissions on the parent directory. Specifically you want to not grant "Execute" (grant R, not RX) to anyone, especially the special CREATOR-OWNER user. This will deny Execute to everything.

-

chmod -x * -R makes files NOT executable, and chmod +x * -R makes them executable.

-
Since the OP didn't state it, I'm guessing from their [Windows] tag that they may not have chmod. –  jscott Sep 26 '12 at 2:00
Oh, my bad. Didn't see that. –  ionFish Sep 26 '12 at 2:01