I am archiving files into self-extracting .exe files. I want the user to have to copy the .exe to their machine in order to execute (extract) the files. So I want to deny only execute permission. They should still be able to write new files, and traverse folders. Possible?
1
-
Duplicate of serverfault.com/questions/114705/… and serverfault.com/questions/90135/…– Mark SowulMar 3, 2011 at 2:10
Add a comment
|
5 Answers
This is not a duplicate post as Mark labeled it as. The valid, and different, question is setting execute to deny but still allowing traverse folder permission. In Server 08, the permission is labeled as "Traverse folder/Execute file". This is found in the properties > security > advanced >permissions section.
To allow "traverse folder": edit the permissions for the user/group you want and check "allow" for "traverse folder/execute file" and whatever else you want. Click ok to set the permissions. *Note: make sure you have the "Apply to:" drop down set to "this folder, subfolders, and files" (or "this folder and subfolder").
This is where things change... To deny executing a file: (still in the advanced permissions tab), add the same user/group you just edited the permissions for, but this time in the "apply to:" drop down select "files only" option and check "deny" in the "traverse folder/execute file" box. Click ok.
You should now be able to traverse folder and not execute file.
The deny will not overide the allow traversal since it is applied to the files in the folder and not the folder/subfolder themselves. You will now have two permission entries under your permissions. One for the allowing traversal and everything else. the second, just for denying execution of files.
To allow users to traverse folders & subfolders, but not execute files, go to the Advanced permissions dialogue for the top level folder in question and set the Traverse folder / execute file permission and Apply to: This folder and subfolders. Doing it this way means you do not need an explicit deny execute because you have only granted the allow permissions on folders & subfolders, not files.
If I recall correctly, you'll find what you are looking for under the security settings of the folder. Just right click the specific folder, select properties, then the security tab. You can set just read and write capabilities without giving execute rights.
-
I see that. There is Read & execute. When I click "Deny" it automatically sets Deny for List folder contents and Read. If I uncheck either of those 2, then it unchecks "Read & execute" as well.– esacJan 11, 2011 at 20:02
-
1Also, if I go into Advanced Permissions, it says "Traverse folder / execute file". So I can disable execution, but then the user can not navigate under subfolders??– esacJan 11, 2011 at 20:03
-
Under the Security tab, you should have the option for Read & Execute as well as just a Read option. Just give Read permission and also the Write permission. Go to Advanced and set the following: List folder/Read data, Read attributes, Read extend attributes, Create files/write data, Create folders/append data, Read permissions. Apply it to 'This folder, subfolders, and files.– MikeJan 11, 2011 at 21:55
-
besides Mike's advice, you have firstly choose the kind of user to whom apply rights. So, if you want apply these restrictions to a normal user, you have to find group "Users" or which you prefer or you have to create a group and add all the users you want and apply rights to this new group.
Seems that execute file permission is applied only to exe files. Is there any way how to restrict it for any file type (xlsx/txt/...)?
