We have the following layout

•Shared Folder "Clients"

•Level 1 ("Client A"/"ClientB"/"Client C"/etc)

•Level 2 ("Folder 1"/"Folder 2"/"Folder 3"/"Folder4")

•Level 3 ("Word Docs / Spreadsheets / Raw Data / etc")

Users have a mapped drive and access the folders as follows: Clients on server T:\Client A\Folder 1\Word Doc1.doc Each Client folder has 4 sub folders at level 2 as shown above.

The problem we have is users are accidentally saving/moving/deleting folders at Level 1 and Level 2.

We have a group called Admin Staff who are the users who create the folders at Level 1 and Level 2 when a new client is added onto the system. These users need to create / delete / ammend all details at all levels.

All other users for example Domain Users must not be able to make any changes to Level 1 or Level 2 folders. However they must be able to work within the various folders at Level 3. At level 3 the users can create their own sub folder structure if they like and we are happy for all users to have read/write/modify at this level.

What is the best way to configure network permissions to achieve this task to prevent users moving folders by mistake or deleting client folders.


5 Answers 5


This is what I would do:

Level 1 & 2 - Admin Group - Write, Modify, Read, etc. Users - Read, List Folder Contents, Read and execute

Bottom levels - Users - add Write and Modify permissions.

You can add permissions at the lower levels w/ no problems. Taking away permissions at lower levels is where you have to remove the inheritance and then copy permissions, then remove what you don't want.


We have one folder that was constantly getting moved on accident into a neighboring folders, so we created a hidden folder called '~Anchor' that users don't have rights to do anything with. This seems to be the first thing that the system attempts to move and so it prevents any other part of the folder tree from being moved. Yet, still leaving users the ability to rename and move all the sub folders and files around if they need to.


It is much better to deny the delete privilege for the target users, since "Modify" permissions imply "Delete", which is what happens when you move the directory.

This is significantly faster and easier (instead of the GUI) if you use the Xcacls.vbs tool. The command might look something like this:

cscript xcacls.vbs "<target_directory>" /e /d "<domain\username>":;A

cscript xcacls.vbs "D:\Level1\Level2a" /e /d "MyDomain\LUsers":;A

The options I chose include the "This folder and subfolders only", so it will not inherit to prevent people from deleting or moving files, but you will want to run the command for each directory you want to protect.

  • I don't see where he would actually need to deny permissions anywhere. The only people w/ "Modify" permissions at the top 2 levels are admins, which is how it's wanted. The regular users have "Modify" at the lower levels, which is how it's wanted. Plus, "Deny" takes precendent, so if an Administrator is part of Users and Admins for some reason, they will be denied the desired access.
    – Dustin
    Aug 27, 2009 at 18:24

You'll have to create a read-only ACL on the top-level folder itself and remove inheritance/propagation, then read-write to it's contents and possible sub-folders. Sounds like a mess. Good luck.


If your users are anything like ours, the most likely cause of accidental moves is inadvertent clumsiness during drag and drop operations. Maybe some tuning of the DragHeight and Dragwidth settings under HKCU\Control Panel\Desktop might be a less radical solution?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.