It's a single folder containing the files. Each time I make a change, I do "Save As" and increment the version number. However,
sometimes I accidentally hit "Save" and overwrite my file – Steven
Vascellaro
How to make files within a folder read only accessible
You can use ICACLS and explicitly deny the write attributes permission to all the files within a specific folder and prevent yourself (or any security group) from overwriting or modifying these files but still allow read access to open them.
Below is a batch script with environmental %userdomain%\%username%
variables to define the current domain (or local machine name) and username signed onto the machine you execute the batch script as (i.e. <domain>\<username>
) to deny the access to the account; this can easily be replaced with any valid domain security group name if needed as well (i.e. <domain>\<securitygroupname>
).
Batch Script
Replace the value of the Folder=
variable to be the full explicit folder path (or UNC path) to the location you need to make the existing files within read only accessible.
@ECHO ON
SET Folder=C:\Users\User\Desktop\Test
SET Security=%userdomain%\%username%
ICACLS "%Folder%\*" /deny "%Security%":(OI)(WA)
EXIT
If you look at the file ACL permissions, you will see the write attributes with an explicit deny now that applied to this folder and files.
Here's a folder with test documents with V1, V2, and so on which has already had be batch script run against.
If you try to save the file the save as dialogue will pop up, and if you try to overwrite the file that already exists with the same file name, you will get an access denied error message since that file is read-only accessible for this account.
You simply do a save as, give the file a different name but to the same folder which you locked down all the files to be read only accessible, and this is where you'd increment your number up by one or whatever.
Any newly saved files in this folder will now have the write attributes denied and thus these permission restrictions are applied to it effective immediately once the file with the new file name is saved to this folder.
Further Reading and Resources
Environment Variables
ICACLS
/deny Sid:perm explicitly denies the specified user access rights.
An explicit deny ACE is added for the stated permissions and
the same permissions in any explicit grant are removed.
WA - write attributes
inheritance rights may precede either form and are applied
only to directories:
(OI) - object inherit