1

I know this has been asked but every answer I have tried over the past three hours has not worked. So I'm hoping to get a solution that works on my machine (running Windows 7).

Assuming following set up

Parent
  File1
  File2
  SubFolder

I would like to set the permissions on Parent so that it cannot be deleted/moved/renamed but the subfolders and files (e.g. "File1"; "File2"; "SubFolder") all retain permission to be deleted/modified in anyway.

What I have done. Right click "Parent" > Properties > Security Tab > Advanced > Change Permissions > Deselect "Include inheritable permissions from this object's parent" and then select "Add" in the dialog that appears > Select "Administrators" > Edit > Apply to: "This folder only" > Check Deny for "Delete"

I then apply everything. However, I am still able to delete the folder.

Any help is much appreciated. Happy to supply screenshots or any additional information needed

Update Attached are screenshots of my current settings. However, I still can click the folder and then hit the delete button on my keyboard and the folder will delete. I tried both with and without the explicit deny permission for delete and both times with the following settings was able to delete the folder as the logged in user.

Set Owner to SYSTEM

enter image description here

Permission Entries

enter image description here

User Permissions for the Folder

enter image description here

User Permissions for Subfolders

enter image description here

System Permissions

enter image description here

Explicit Deny Delete Permission for User (Tried with and without)

enter image description here

  • What or who are you trying to prevent from deleting or changing the folder? – Appleoddity Oct 17 '18 at 3:44
  • It's quite pointless to try to prevent Administrator access, because an administrator can always take ownership and change the permissions. – kreemoweet Oct 17 '18 at 5:05
  • Are any of the users you wish to prevent from deleting the parent folder a member of the Administrators group? – Twisty Impersonator Oct 17 '18 at 11:28
  • Essentially, the parent folder is a dropbox folder we use here at the office. Occasionally some of the less careful employees accidentally move the folder or rename it. Once that happens the folder contains approximately 50k files and dropbox begins syncing every single file, which cripples our computers. I am not worried about them being able to change permissions, it does not need to be that secure just to prevent inadvertent changes to the parent folder – user577732 Oct 17 '18 at 14:16
3

As a rule of thumb, you should avoid explicit DENY rules in ACLs. If one is required, it is often because the data is already structured wrong.

The ability to delete or rename a folder is not decided by the Delete permissions on the folder in question, but by the Delete subfolders and files permission on the parent folder. This is counter-intuitive and different from how permissions for a file work. It definitely doesn't work as you would expect.

Let's use the following folder / file structure as an example:

FolderA
    File1
    FolderB
        File2
        FolderC
            File3

FolderB and File1 are in parent FolderA. FolderC and File2 are in parent FolderB and so on.

Now, if we remove the Delete permission from File1, File2, or File3, for any user, that user will be prevented from renaming and deleting the file. This is also true if you use an explicit DENY Delete on the file.

However, if you remove the Delete permission from FolderA, FolderB, or FolderC, for any user, that user will still be able to rename and delete the folder. This is also true if you use an explicit DENY Delete on the folder.

Why is that? Because the Delete permission is a permission that applies to files, not folders. Instead, we must remove the Delete subfolders and files permission from the parent folder to accomplish what you are asking.

In our above example, we will need to remove the Delete subfolders and files permission from FolderA, for a particular user, assigning the permission to this folder only. In that case, the user will then be unable to modify FolderB and File1. The same is true if you use an explicit DENY Delete subfolders and files on FolderA instead.

The user can still rename and delete FolderA unless the parent of FolderA has also restricted that permission. As long as you applied the permission to this folder only then the user will continue to be able to read/write/modify File2, FolderC and File3.

The obvious drawback here is that it takes 2 levels of folders to accomplish what you are asking. In your case, you mention that you are trying to protect a Dropbox folder. So, your folder structure would have to look like this:

Dropbox
    Protected Folders
        File1
        File2
        FolderA
    Protected Files

You would remove, for a particular user or group, the Delete subfolders and files permission for this folder only on the Dropbox folder. You would then add or maintain, for a particular user or group, Full Control or Modify permissions for subfolders and files on the Dropbox folder.

Now the affected user will be unable to modify any files or folders immediately below the Dropbox folder, but will be able to modify all files and folders contained in any subfolders.

There is an additional concern here with Dropbox, because this is not a normal folder. The Dropbox application expects full control of the Dropbox folder. Being that Dropbox often runs as the logged on user, you can't prevent the logged on user from having full control of the Dropbox folder. You can try it, but the results may be unpredictable and chaos is likely to ensue.

  • Unfortunately I still was able to delete the folder after following your steps. I have included screenshots of my various windows to show you what I currently have set. Let me know if there's anything additional I should do. I also left a comment on my post with further information as to why I'm looking to accomplish this. Thank you! – user577732 Oct 18 '18 at 2:19
  • @user577732 Yes, I spent quite a bit of time researching and testing. Many online suggestions are wrong. I have updated the answer for you. The answer being that Delete is a file permission not a folder permission. You need to remove Delete subfolders and files permission from the parent of the folder you want to protect. The drawback being that all files and folders in that parent folder will not be able to be modified. – Appleoddity Oct 18 '18 at 6:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.