How to grant a group of users only the delete permission?

Question

I am using a shared PC (Windows 10), and I want a group of users (User: Everyone) to be able to delete a directory completely. However, they should not be able to open the directory or view the directory structure.

This directory contains confidential files, and I do not want anyone to see them. This can be easily achieved by changing the permission. However, when I do that, no one can delete the directory without changing permission. This is an issue because if the directory gets too big, any user should be able to delete the directory.

I have already tried granting delete permission, but users still cannot delete it.
Can this be achieved using Windows 10?

Answer 1

This approach will not work, because the delete permission cannot function by itself and requires more permissions than you are willing to give.

You will need a totally different approach, complicated by the fact that your users are presumably not administrators.

The one I suggest is to create an Event Log trigger that will launch a task that will delete the folder in question. Users will activate the trigger by writing an entry to the Event Log, which could also be a handy method for keeping track of these actions.

For creating the trigger, see the post
Run task scheduler task on demand from limited user account in windows 7.

For creating a PowerShell script that writes to the Event Log see the article
How to Use PowerShell to Write to Event Logs.

You will need only once to create your own event source as Administrator. This PowerShell command will create the source under the "Application" tree:

New-EventLog –LogName Application –Source "My Script"

Writing to the log can be done by any user with a PowerShell command such as:

Write-EventLog –LogName Application –Source "My Script" –EntryType Information –EventID 1 –Message "This is a test message."

Answer 2

Using NTFS file system, you cannot delete a file or folder without being able to read it. There is no permissions combinations (allow/deny) that will work.

Without read permissions, you cannot rename or delete a file or folder. Note that the owner of a file or folder will have permissions even if not set explicitly.

Unfortunately, the NTFS specifications are not public as it is a Microsoft property and is licensed so there is no way to prove this claim.

But there are some documentations available related to the implementation of NTFS under Linux.

If you have enough development knowledge, check how Access Masks are implemented: http://dubeyko.com/development/FileSystems/NTFS/ntfsdoc.pdf