Recently I was trying to restrics "delete" permission for usual users. To do that, I've done the following:

(translating from Polish Win version, may be small differences) Right mouse click on given directory -> Properties -> Security -> Advanced -> Change permissions -> I've unmarked first checkbox to stop inheriting permissions from parent dir -> I've added special permissions for users - "Delete" and "Delete subfolders and files".

As a result I cannot delete these files/directory as a normal user, it's asking me about admin password - it's great, as I expected. However when I input admin password, file is not deleted and there is an messabe box informing, that I need admin permissions to perform this operation. Also, when I try to repeat these steps for admin, it gives me the same result, I cannot delete files/directory on which I performed above changes, even when I'm logged as admin account on which I performed these changes.

Can anybody help me solving my problem? I don't understand, why denying delete permissions for users makes it impossible also for admin user...

To answer your first questions, hidden Administrator account was disabled and I was not using it, just used my admin account.

  • 1
    Please post a screen shot of the permissions on the folder in question. – Twisty Impersonator May 1 '17 at 12:14
  • Would screenshots with Polish text be useful enough for you? ibb.co/ecD6qk ibb.co/nDe1O5 ibb.co/f3szAk ibb.co/dXp1O5 "odmów"="deny", "użytkownicy"="users", "administratorzy"="administrators", "specjalny"="special", "pełna kontrola"="full control", "usuwanie"="delete" – Kamil K May 1 '17 at 16:27

Deny ACE's are evaluated first and take precedence over everything else. If you want to delete an object that is inheriting a Deny ACE, you need to clear the inheritance flag, and then remove the Deny ACE from only that object.

Using "deny" to prevent delete is a very tricky business. Instead of granting Change which include Delete, grant only Read.

This explains in detail https://technet.microsoft.com/en-us/library/cc783530(v=ws.10).aspx For example, you might want to allow domain administrators to perform an action but deny domain users. If you attempt to implement this by explicitly denying domain users, you also deny any domain administrators who are also domain users. Though it is sometimes necessary, you can and should avoid the use of explicit denies in most cases.

  • I understand, but here deny is only set for normal user, not for admin... ibb.co/ecD6qk – Kamil K May 1 '17 at 16:28
  • Also, I think deny ACE is not inherited from any parent directory, as there is no deny rule in directory above given one. In this case, as I understand it correctly, deny should only be in use when normal user tries to delete files in this directory - am I wrong? – Kamil K May 1 '17 at 16:41
  • 1
    The administrator account is still subject to Deny entries for the Users or Domain Users groups, because in those respects it is also a user. If its not an inherited ACE, then you only need the 2nd step of my response, remove the Deny ACE from that object. If you remove the Deny and are still having issues, then the Deny is not the cause. – Clayton May 1 '17 at 18:06
  • Is my "K" account also a user? It's only member of administrators and some group called HomeUsers - please see screenshot ibb.co/ijiL0k I don't want to deny ACE from given object as I want this rule to be universal. What else should I do to have delete option for such files for "K" account and not have this option on "Internet-Pobrane" usual user? – Kamil K May 1 '17 at 19:22
  • Are you by chance attempting to protect users from accidentally moving things that should not be moved? If so see superuser.com/questions/713003/… – Clayton May 1 '17 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.