How do I prevent a user from deleting a sub-folder within a sub-folder of a share?

Question

I have a group(GroupA) that needs access to a sub-folder(FolderA2) of a sub-folder(FolderA1) of share FolderA.

Shared folder FolderA and sub-folders:

 FolderA
  |
  +--FolderA1
     |
     +--FolderA2

This is what I am trying to accomplish(Steps 1 and 2 working fine):

1. FolderA share restricted to Read only, I don't want users to be able to create folders or files in the root of the FolderA share.

2. GroupA should be able to create,delete, and modify folders and files in FolderA1 folder but not be able to delete the FolderA1 folder. I have this working fine up to this point.

3. FolderA2 must only be accessible to a couple of users that also belong to GroupA as this folder contains sensitive information that only two users should be authorized to access.

Since I have everything working fine up to step 2 or sub-folder FolderA1, I will only describe what I have done for FolderA2.

To address FoderA2 issue, I have done the following:

1. Created GroupB
2. Added users to GroupB that need access to FolderA2
3. Disabled inheritance to FolderA2.
4. Removed GroupA access

5. Added GroupB access to FolderA2 security and Applied to "This folder only" and selected the following under advanced permissions:

   • Traverse folder/execute file
   • List folder/read data
   • Read attributes
   • Read extended attributes
   • Create files/write data
   • Create folders/append data
   • Write attributes
   • Write extended attributes
   • Delete subfolders and files

   • Read permissions

     6. Added another GroupB access to FolderA2 security and Applied to "Subfolders and files only" and selected the following under advanced permissions:

   • Traverse folder/execute file

   • List folder/read data
   • Read attributes
   • Read extended attributes
   • Create files/write data
   • Create folders/append data
   • Write attributes
   • Write extended attributes
   • Delete subfolders and files
   • Delete
   • Read permissions

After applying this access rights, I tested users that belong to GroupA and they are indeed not able to access FolderA2 which is good. Now I try users that belong to GroupB and they can access FolderA2 as intended but they are also able to delete FolderA2 and that is NO GOOD. They are not supposed to be able to delete that folder. How do i get around this?

NOTE: Just so you know, since the users that need access to FolderA2 are already members of a group that has access to the share FolderA and sub-folder FolderA1, I did not add GroupB access to FolderA share or FolderA1 sub-folder. I just added GroupB access to FolderA2.

======The following are the images that show the settings of the folders======

FolderA Share Permission

FolderA Permission Entry:

Advanced Security Settings FolderA1:

FolderA1 Permission Entry 1:

FolderA1 Permission Entry 2:

FolderA2 Advanced Security Settings:

Permission Entry for FolderA2:

Permission Entry 2 for FolderA2:

When testing user access that has access to FolderA2, access is denied:

If I add "List Folders" a 3rd permission applied to "This folder only", I can access the folder. I can delete files and folders but I can't create files or folders and I am able to delete FolderA2.

Answer 1

They are also able to delete FolderA2 and that is NO GOOD. They are not supposed to be able to delete that folder. How do i get around this?

You can run the applicable icacls commands to the specific and explicit folder you wish to lock down, and DENY the DELETE permission at that folder level to GroupB. So once you get GroupB setup with the access you need it as you explain, simply run this command and all should be set as you need it.

1. Disable Inheritance

Right-click the FolderA2, select Properties, Security tab, Advanced, Disable Inheritance, select the Convert inherited permissions into explicit permissions on this object option, and then click Apply > OK.

Back in the Security tab of FolderA2 properties, select the Edit button. Now select and remove all groups and accounts listed but leave Domain Admins, System, and Creator Owner, Apply, OK.

Now run the below iCALCS Command against the FolderA2 folder just as shown, then click Apply > OK.

2. iCALCS Command

_{Be sure to look over Disable Inheritance and complete that before you run this command}

icacls "\\server\FolderA\FolderA1\FolderA2" /deny "GroupB":(DE)

BONUS NOTE: The above also prevents the infamous inadvertent drag and drop of the folder too.

WARNING: If in a domain environment, please allow up to one hour for security changes become effective. Once security changes do become effective, user accounts may need to logoff and then back onto a computer\system before they'll get the newly setup NTFS ACL security permissions.

---

Equivalent GUI Method

3. Explicit Deny

Right click on FolderA2, select Properties, go to the Security tab, and select the Advanced button. From the Advanced Security window, select the Add button. Then from the Permissions Entry window, click on the Select a principal option, and type in GroupB and press Enter. From here you will select the Deny permission in the Type field, and select the This folder only in the Applies To field. Lastly, just ensure that only the Delete option is selected in the Advanced Permissions window, and press Apply > OK.

4. Explicit Allow

Be sure that any MODIFY permissions you grant or allow GroupB to have to FolderA2 explicitly that you're sure you apply it to Subfolders and files only otherwise the GroupB may get the ability to delete the FolderA2 from this configuration explicitly from what I tested.

---

Further Resources

• iCACLS

  • DE - Delete

  • /deny user:permission

    Explicitly deny the specified user access rights.

    This will also remove any explicit grant of the

    same permissions to the same user.

Answer 2

Updated server. Same issues.

Users and Groups:

GroupA

UserA

GroupB

UserAB

Thanks for all the help Walmart. It seems that the problem was at FolderA1. Here's the pictures of security rights of the folders:

FolderA Share Permissions:

FolderA Advanced Security Settings:

FolderA Permission Entries:

FolderA1 Advanced Security Settings:

FolderA1 Permission Entries:

Entry 1:

Entry 2:

FolderA2 Advanced Security Settings:

FolderA2 Permission Entries:

Entry 1:

Entry 2:

This works great. Locks out unauthorized users from FolderA2.

I am still puzzled with the effective rights for GroupB on FolderA2, see below:

GroupB Effective permissions on FoderA2:

UserAB Effective permission on FolderA2:

Again, thank you.