5

I have a user account set up so that it can create folders/files, but it can NOT delete folders/files created by other users; however, they still can delete folders/files that they have created. I do not want them to be able to do this.

Is there a way I can disallow users from deleting things, even if they are the owner/creator?

Or, can I automatically change the owner of a folder/file to admin when it is created, therby blocking the general user account from being able to delete it?

Any ideas or suggestions?

  • 2
    Do they need to be able to modify the files once created? Many applications 'save' a file by writing a temp file, removing the original, and renaming the temp file to the original name. This save(temp)+delete+rename(temp) means you always have a good copy of the file stored, compared to a direct over-write which could destroy all the data if something crashed at the wrong time. Anyway my point is, if you deny deletes, you break many programs. – Zoredache Jul 20 '17 at 21:14
2

Prevent NTFS Object Owners From Changing Permissions

If users access their data through a Windows network share, a system administrator can prevent the Owner of an NTFS file or folder from changing permissions by not granting the Full Control share permission:

enter image description here

Credit to this article for the concept.

Therefore, whatever permissions are granted to users in the first place will remain in effect, even for object owners, as they won't be able to exercise their ability as Owner to grant themselves permissions not permitted by the server administrator.

2

The key is that users can delete a file if the file's ACL entitles them to delete it or the containing directory's ACL gives them the delete-child permission. You need to make sure that this limited user doesn't get either permission. On the special folder from which they shouldn't be able to delete files, assign them the following permissions in the Advanced Security Settings window:

  • Allow "traverse folder / execute file", "list folder / read data", "read attributes", "read extended attributes", "create files / write data", "create folders / append data", and "read permissions" on "this folder and subfolders"
  • Deny "delete subfolders and files", "delete", and "change permissions" on "this folder, subfolders, and files"
  • Allow full control on "files only" (this will be moderated by the previous deny rule)

But because this user is the owner of any files they create, they are entitled to change the permissions to allow deletion. The last piece of the puzzle is the arcane OWNER RIGHTS principal. You can type that phrase right into the user selection dialog where you would usually type the name of a user or group. Create one last rule on the folder that grants only "read permissions" on "subfolders and files only" to OWNER RIGHTS. Then the only advantage of being the owner of a file in that folder is that it guarantees ability to see the ACL, but not to change it.

  • This is fantastic--especially because unlike my answer, it can be enabled granularly instead of on the entire share. I did not know about the OWNER RIGHTS identity. Is there any documentation that explains this security principle further? – I say Reinstate Monica Aug 1 '18 at 21:37
  • @TwistyImpersonator Official documentation is pretty scarce - all I could find was a terse but complete description in this list of built-in principals and this rather unhelpful specification subsection. Third-party articles such as this one explain it at greater length. – Ben N Aug 1 '18 at 21:50
0

Simply use deny permissions, as they overrule allow permissions.

Do note that in any case, the owner can modify the permissions to allow deleting files. If that happens, it is a clear act of will, and not by accident, which usually is okay.

Also, do note, if you set deny permissions, its likely you, some programs and scripts running on the server, will no longer be able to delete or move files either, until you alter the permissions again.

  • This would be true if it weren't for the fact the user owns the file. Object/file owners can change the permissions on a file, regardless of what permissions they have on the object, including cases where they've been denied permissions to said file. – I say Reinstate Monica Jul 17 '18 at 0:47
  • @TwistyImpersonator yes, which is what I wrote in my answer. Owners with deny permission will still get the deny permission results, but they can overrule it. So in that case, the person knows what they're doing and know they're changing the permissions. – LPChip Jul 17 '18 at 6:34
  • @TwistyImpersonator This can be prevented by adding a rule for the obscure OWNER RIGHTS principal. If there is such a rule and it doesn't grant the "change permissions" permission, the owner will not be guaranteed the ability to edit the ACL. – Ben N Aug 1 '18 at 21:19
0

Depending on just what your reasons for wanting this is, periodic back-up to a location the user doesn't have access to could be a solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.