How do I allow users to write to files but not allow them to create or delete folders? Which NTFS permissions do I need to set?
Open the Advanced window on the Security tab. Click Disable inheritance to allow the removal of inherited settings; let it copy the currently inherited rules. Remove the rule(s) that allow all access to people who shouldn't have it. Then grant the following rules to the group that should have access to files only:
- All basic permissions except Full control, applied to Files only
- The advanced permissions Traverse folder / execute file, List folder / read data, Read attributes, Read extended attributes, Create files / write data, and Read permissions, applied to This folder and subfolders
(There's a link in the upper-right of the advanced permission entry editor to switch between basic permissions and advanced permissions.)
You can also grant full control on everything to the principal that shouldn't be restricted. In this example, I've allowed Authenticated Users to read/write all files in this folder and subfolders, but only I and Administrators can create/delete folders themselves:
- Right-click the folder you want to set permissions on and click Properties.
- Go to the Security tab.
- Click the button labeled Advanced
- Click Change Permissions
- Click Add...
- Enter the username or group you are granting permission to
- Click OK
When you click OK, a more detailed list of permissions comes up. You can Allow or not Allow or Deny "Create folders/append data" as well as "Delete subfolders and files".
You may need to uncheck the "Include inheritable permissions..." option in the dialog box from step 5.