Here I have a folder (E:\projects, which is also shared via the network) with several hundred folders like E:\projects\project1, E:\projects\project2, E:\projects\project3.... Each of these folders contains several subfolders and files. Currently all users have full permissions on all files and folders.

I want to change it so that the folder level of e.g. E:\projects\project1 must not be deleted. The users shouldn't be allowed to delete the folder E:\projects\project1, but they should be able to do what they want with its content.

Currently I'm failing to express this to Windows' permission system. When I'm in E:\projects and deny the permission "delete" for subfolders, it does this recursively. But this is exactly what I don't want to have. Only the folder structure exactly one level below E:\projects should get this.

Does anyone have a hint for this?


In response to Thecleaner:

I'm afraid this doesn't work as intended. The user is still able to delete this folder. Currently I'm trying this solution: granting the user group the permission to "traverse folder/execute file", "list folder/read data", "read attributes", "read extended attributes" and "read permissions" - only for this folder. "Delete" and "delete subfolders and files" is denied for this group. Then I added another permission for this group which gives full access only for subfolders and files. This results in the behaviour that the users can still move the folder E:\projects\project1 to another place. But why? I don't get it...

The user is a member of the following groups in the AD:

Domänen-Benutzer, Entwicklung, EAGLE, mup_com, archive, projecte, CPUWIN_mup, MP, Remote Web Workplace Users, Benutzer von Windows SBS-Remotewebzugriff, Windows SBS-Faxbenutzer, Konten für die Windows SBS-Ordnerumleitung, All Users, Windows SBS-Linkbenutzer

1 Answer 1


On E:\projects\project1 set the deny to only that folder and files and don't apply them to the child objects. ie...do it on the actual folder you want set, not at the E:\projects level.

enter image description here

  • Ok, these are two good suggestions. It was my hope that I don't have to touch every subfolder manually (160+). Maybe there is a shell/Powershell way to do this?
    – André
    Jul 24, 2013 at 15:10
  • Did you verify this works like you wanted for a single folder? If so, I can look a getting you a PS script. Put a screenshot of the individual folders permissions you set that works now.
    – TheCleaner
    Jul 24, 2013 at 17:23
  • I've edited my initial text - it isn't working as I expected... maybe you have an hint.
    – André
    Jul 25, 2013 at 14:41
  • sure, let me reproduce the environment and I'll let you know. What server OS?
    – TheCleaner
    Jul 25, 2013 at 14:48
  • It is a Windows SBS 2011 Standard. Tomorrow I can give you more details on the group memberships.
    – André
    Jul 25, 2013 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .