Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A little background: I've got a citrix server with about 20 accounts that are used in a round robin fashion by various remote users to access a published application. This application allows users to upload documents to a common directory and these accounts all have the same access to the filesystem. Recently there's been some concern regarding the ability for users to overwrite, rename, or delete files in the upload directory (none of the citrix accounts are tied to users within the published application so app enforced restrictions won't apply).

I'd like to give this group of citrix users the ability to create and read files in the upload directory, but not the ability to rename, delete, or overwrite existing files. Is this possible? I'm thinking something along the lines of the following, but I'm not entirely sure whether this would prevent renaming or overwriting.

revoke delete permissions (D - delete):

    icacls <document dir> /deny Everyone:D

grant write data/add file (WD - write data/add file):

    icacls <document dir> /grant <citrix group>:WD 

grant read (GR - generic read):

    icalcs <document dir> /grant <citrix group>:GR
share|improve this question

You must log in to answer this question.

Browse other questions tagged .