Been struggling with this since yesterday without success. Tried all kinds of combinations.

I have 2 files - an EXE and a config file. When users start the EXE they should be able to save their configuration which modifies the config file. They shouldn't be able to delete the parent folder or the exe, nor should they be able to add new files to that folder. They must have rights only to modify the config file. Thing is that when I give 'Create files / write data' permissions to the folder user is able to save his config but he's also able to save a file in the folder. When I remove this permission user is unable to save his config. It doesn't matter that I gave 'Full' permission to the config file itself.

Is what I'm trying to do even possible? In my logic setting 'Full' permission to a file should give the user full rights to that file no matter what the parent folder has.

  • You can give the permission to modify a specific file in a folder but deny the creation of new files. You can also deny the ability to delete that file. However, if the application creates a file, instead of modifying the file then your hands are tied. The permissions I describe are in the advanced list of permissions (I.e delete permissions)
    – Ramhound
    Commented Jul 22, 2021 at 12:45
  • Yes, I've been tinkering with the advanced permissions. And yes, I've been reading here and there that modifying a file is actually deleting the old 1 and creating a new one (when you save) but wanted to confirm that there's nothing I can do. What I see when I click on 'save setting' in the app is that the config file changes its 'date modified' date. Does that mean that the app is creating a new file and that's why I can't achieve my task?
    – bolshed
    Commented Jul 22, 2021 at 12:52
  • No; Modifying a file is not the same as deleting it and recreating it. There are two ways to modify an existing file as a programmer. You replace it with a new file, or you modify the existing file, what your executable does I couldn't say.
    – Ramhound
    Commented Jul 22, 2021 at 13:06
  • 1
    ACLs should allow what you're looking to do, but if not, either change the program's config file location to %AppData%\<ProgramName> / %LocalAppData%\<ProgramName> (this is where user-modified config files are supposed to be stored) || %ProgramData%\<ProgramName>, else create a subdirectory in the program's folder and configure the program to default its config file to there. If there are only a few users, another option would be to install the program to each user's %AppData% directory, but this shouldn't be necessary since ACLs should allow you to do what you're looking to do.
    – JW0914
    Commented Jul 22, 2021 at 13:12

1 Answer 1


You may easily find out if the program creates a new file or modifies the existing one (I think that the second option is unlikely).

In Windows Explorer, right-click the headers and select both the columns "Date modified" and "Date created" are shown.

Run the program and then compare the two dates:

  • If "Date created" is from before this time, then the file is modified.

  • If it is later, then what you are looking for is impossible, since the program creates a new file rather than overwriting the old one.

  • Well the file is modified. When I change and save the app settings the date modified changes but the date created stays in the past. How can I accomplish what I'm trying to do? Tried all kinds of combinations through folder/file properties and icacls.
    – bolshed
    Commented Jul 22, 2021 at 17:55
  • You may use the Properties of the folder to deny Write to the user accounts in question. Ensure they have this right to the files, if necessary disable inheritance from the folder. Other rights to be set within reason, like read, execute and list. It may take several iterations before getting it right.
    – harrymc
    Commented Jul 23, 2021 at 7:46
  • Many reference sources exist. For example File and Folder Permissions in Windows.
    – harrymc
    Commented Jul 23, 2021 at 7:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .