I am attempting to take away delete privileges on a test network share but still allow for folder and file creation. My users tend to drag directories inside directories and cloud based backups get off kilter as a result. My hope is that if I properly lock down the existing shares that I can stop all of that.
I made a share called test and gave my domain account full control along with the built-in administrators group. I then gave read/write/execute permission to a global security group on my domain called "public shares users". Under special permissions for that group I verified that delete, delete subfolder and files, take ownership, and change permissions were not allowed.
If windows explorer is viewing the mapped drive and I right click to create a new folder I get a permission error (when logged in as a public share user) but I end up with a folder called "new folder" anyways. So it allows the folder creation, but does not allow direct renaming modification apparently. I would expect the folder to disappear because of the permission error though unless the create and rename are two seperate actions.
I can make folders on the desktop and drag them into the explorer window viewing the "test" share and they go through without problem. Once these files/folders have been dragged over then I find that I can not rename, or delete from them (what I want). I CAN however open a existing file and make changes and save it (also what I want).
Is this because I "own" the files and folders that I drag over from the desktop? If yes, how will ownership affect files which multiple users will open and edit (dept specific excel sheet for example)?
Is this "drag in only" behavior by design or just lack of proper configuration? Do I just need to educate my users to organize/rename as needed on their desktop and when ready to "commit" to the network drag it across? They are all used to full control and being able to right click and organize within the share directly so it will be a little different than what they are used to.
Is there anything else I can look into that would allow me to preform renames to files and folders without granting a full "modify" priviledge to that user group? Giving them Modify gives them delete, and if you uncheck delete then it reverts them to "read/write/execute".
Thanks for reading my post.