server 2008 files sharing stress

Question

I running server 2008r2 and i have been trying to deploy permission to my network share folder so that they can only write to existing files and save new documents everything else is restricted including create new folders, i am aware of the advanced permission settings and unticked the relevant setting such as create and append and deletion options. When users try to edit and save documents there is a read only error.

I have been struggling with this problem too long and its critical that i get the company's data secured

Answer 1

Chances are what you're running into is a feature of most program's save cycle. It goes like this:

1. Remove old file.
2. Create new file with updated data.

Some formats (Access is one) actually do modify the existing file with the new data, and those would probably be just fine with your permissions.

However, MS Office formats (except the databasey ones) all do the delete/create method of 'saving'. This means that you must include the Delete right for directories intended to contain Office files.

This does present a serious problem if you're trying to defend against data-desecration attacks by internal actors. The traditional method of handling this one is to not grant Delete to groups that shouldn't have it, but do grant it as part of the "Creator Owner" permission-set; this allows creators of files the ability to delete them which in turn allows the save cycle to work.

 icacls M:\SecureDir /grant *S-1-3-0:(io)(d)

Which will grant Creator Owner the Delete right to objects created under M:\SecureDir.