Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am attempting to take away delete privileges on a test network share but still allow for folder and file creation. My users tend to drag directories inside directories and cloud based backups get off kilter as a result. My hope is that if I properly lock down the existing shares that I can stop all of that.

I made a share called test and gave my domain account full control along with the built-in administrators group. I then gave read/write/execute permission to a global security group on my domain called "public shares users". Under special permissions for that group I verified that delete, delete subfolder and files, take ownership, and change permissions were not allowed.

If windows explorer is viewing the mapped drive and I right click to create a new folder I get a permission error (when logged in as a public share user) but I end up with a folder called "new folder" anyways. So it allows the folder creation, but does not allow direct renaming modification apparently. I would expect the folder to disappear because of the permission error though unless the create and rename are two seperate actions.

I can make folders on the desktop and drag them into the explorer window viewing the "test" share and they go through without problem. Once these files/folders have been dragged over then I find that I can not rename, or delete from them (what I want). I CAN however open a existing file and make changes and save it (also what I want).

Is this because I "own" the files and folders that I drag over from the desktop? If yes, how will ownership affect files which multiple users will open and edit (dept specific excel sheet for example)?

Is this "drag in only" behavior by design or just lack of proper configuration? Do I just need to educate my users to organize/rename as needed on their desktop and when ready to "commit" to the network drag it across? They are all used to full control and being able to right click and organize within the share directly so it will be a little different than what they are used to.

Is there anything else I can look into that would allow me to preform renames to files and folders without granting a full "modify" priviledge to that user group? Giving them Modify gives them delete, and if you uncheck delete then it reverts them to "read/write/execute".

Thanks for reading my post.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

A rename operation is a copy and delete under these covers. You can't rename without delete rights at least on the ntfs file system.

share|improve this answer
    
that makes sense. So I suppose my configuration is working properly then. –  TWood Feb 2 '13 at 14:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.