2

Here I have a folder (E:\projects, which is also shared via the network) with several hundred folders like E:\projects\project1, E:\projects\project2, E:\projects\project3.... Each of these folders contains several subfolders and files. Currently all users have full permissions on all files and folders.

I want to change it so that the folder level of e.g. E:\projects\project1 must not be deleted. The users shouldn't be allowed to delete the folder E:\projects\project1, but they should be able to do what they want with its content.

Currently I'm failing to express this to Windows' permission system. When I'm in E:\projects and deny the permission "delete" for subfolders, it does this recursively. But this is exactly what I don't want to have. Only the folder structure exactly one level below E:\projects should get this.

Does anyone have a hint for this?

=================================

In response to Thecleaner:

I'm afraid this doesn't work as intended. The user is still able to delete this folder. Currently I'm trying this solution: granting the user group the permission to "traverse folder/execute file", "list folder/read data", "read attributes", "read extended attributes" and "read permissions" - only for this folder. "Delete" and "delete subfolders and files" is denied for this group. Then I added another permission for this group which gives full access only for subfolders and files. This results in the behaviour that the users can still move the folder E:\projects\project1 to another place. But why? I don't get it...

The user is a member of the following groups in the AD:

Domänen-Benutzer, Entwicklung, EAGLE, mup_com, archive, projecte, CPUWIN_mup, MP, Remote Web Workplace Users, Benutzer von Windows SBS-Remotewebzugriff, Windows SBS-Faxbenutzer, Konten für die Windows SBS-Ordnerumleitung, All Users, Windows SBS-Linkbenutzer

Improve this question

1 Answer 1

Reset to default
3

On E:\projects\project1 set the deny to only that folder and files and don't apply them to the child objects. ie...do it on the actual folder you want set, not at the E:\projects level.

enter image description here

Improve this answer
11
  • Ok, these are two good suggestions. It was my hope that I don't have to touch every subfolder manually (160+). Maybe there is a shell/Powershell way to do this?
    – André
    Jul 24, 2013 at 15:10
  • Did you verify this works like you wanted for a single folder? If so, I can look a getting you a PS script. Put a screenshot of the individual folders permissions you set that works now.
    – TheCleaner
    Jul 24, 2013 at 17:23
  • I've edited my initial text - it isn't working as I expected... maybe you have an hint.
    – André
    Jul 25, 2013 at 14:41
  • sure, let me reproduce the environment and I'll let you know. What server OS?
    – TheCleaner
    Jul 25, 2013 at 14:48
  • It is a Windows SBS 2011 Standard. Tomorrow I can give you more details on the group memberships.
    – André
    Jul 25, 2013 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.