I have a folderA. I'd like a user (let's call him darth) to be able to do anything (create,read,write,delete) folders/files inside folderA , BUT darth should NOT be able to delete folderA itself. To achieve this I applied the following permissions.
C:\>icacls foldera foldera DHI-VM1\darth:(DENY)(D) DHI-VM1\darth:(RX,W,WDAC,WO,DC) NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Administrators:(OI)(CI)(F) BUILTIN\Users:(OI)(CI)(RX) BUILTIN\Users:(CI)(S,WD,AD) CREATOR OWNER:(OI)(CI)(IO)(F) Successfully processed 1 files; Failed processing 0 files
I know Deny takes precedence over Allow , but in this case the Deny & Allow are for different objects (deny delete on parent folder , allow on child folder). I'm still unable to delete anything inside folderA despite the perission DC (in 2nd line after WO). Why so ?
OS - Windows Server 2008 R2