6

Hopefully you guys will be able to help me out.

=========================

Scenario:

FolderA > FolderB

FolderA Permissions (no inheritance):

This Folder Only

Deny Delete

Allow everything else

Subfolders & Files

Allow everything

========================

With such configuration, I should be able to do everything into FolderA, but not delete or change the name of it, however is not working. I'm still able to delete and change the name of FolderA.

Thanks Heaps

Gabriel

  • Can you please provide the following details. I'm facing similar issues. 1) Output of "icacls" on folderA , any object/container within folderA. 2). What user have you logged in as to delete the folder ? 3) Which user have you denied the delete permission to ? . If users 2) & 3) are different, maybe that's the reason – Dhiwakar Ravikumar Sep 23 '14 at 9:34
  • Hi there...1) FolderB is actually inside FolderA. 2)Just admin can delete folder. 3) Test user cannot delete folder (test user is not part of administrator group). Problem is.....after such permissions...test user is still having access to delete folder. – Gabriel Teixeira Sep 25 '14 at 4:10
2

You have to take into account that deleting/renaming a file is actually a write operation on the parent folder which is a special "file" that contains the list of children (files or subfolders). As such to prevent deleting a file, you need to remove the write permission on the parent folder.

see kb 308419 for an explanation:

The Delete permission allows or denies the user from deleting the file or folder. If you do not have a Delete permission on a file or folder, you can delete the file or folder if you are granted Delete Subfolders and Files permissions on the parent folder.

| improve this answer | |
  • Hi there.....the parent folder (FolderA) has got its permissions changed to deny delete and write (this folder only)......user have full control of everything underneath(FolderB Subfolders and files only). Even though FolderA has got deny permission for delete and write, users are still able to do so. – Gabriel Teixeira Sep 26 '14 at 1:01
  • Can confirm that this absolute DOES NOT WORK, on windows 10. Even with Everyone set to deny both writing and deleting on the parent and the files, you can still delete both. – Jonathon Apr 6 '16 at 22:01
1

To properly deny access to delete from the parent folder only and allow deleting from the subfolders you have to set two sets of permissions for the user/group.

  1. Allow read write modify. This is important: keep "delete subfolder and files" checked off but uncheck "DELETE". I have found that if a user has permission for "delete", any deny permissions will not work! This should be applied to this folder, subfolders, and files.

  2. DENY the user delete and "delete subfolders and files" and apply to this folder only.

I spent a lot time figuring this out and it works!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.