How can you stop users from moving folders and files in a Windows 2008 share, but still allow them to create new folders, rename folders, open files and save files?
1 Answer
You can't without breaking permission inheritance on the folders that you don't want moved. These are the relevant permissions:
List Folders / Read Data
Traverse Folder / Execute File
Create Files / Write Data
Create Folders / Append Data
The problem is that Create Folders / Append Data
and Create Files / Write Data
is what lets you move a folder, but it's also essential to let them make new folders and data.
Depending on your directory structure, you could give only Traverse Folder / Execute File
and List Folders / Read Data
on the folders that you don't want moved and them give Modify (or whatever) on the children of that folder.
Example:
Assume a directory structure like this:
-top_folder
--subfolder1
--subfolder2
If you set top_folder to: No inheritance, Traverse / List for This Folder Only
, Modify for All Subfolders and Files
Then they wouldn't be able to change top_folder in any way, but they could modify anything under it.