2

I have a folderA. I'd like a user (let's call him darth) to be able to do anything (create,read,write,delete) folders/files inside folderA , BUT darth should NOT be able to delete folderA itself. To achieve this I applied the following permissions.

C:\>icacls foldera
    foldera DHI-VM1\darth:(DENY)(D)
        DHI-VM1\darth:(RX,W,WDAC,WO,DC)
        NT AUTHORITY\SYSTEM:(OI)(CI)(F)
        BUILTIN\Administrators:(OI)(CI)(F)
        BUILTIN\Users:(OI)(CI)(RX)
        BUILTIN\Users:(CI)(S,WD,AD)
        CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

I know Deny takes precedence over Allow , but in this case the Deny & Allow are for different objects (deny delete on parent folder , allow on child folder). I'm still unable to delete anything inside folderA despite the perission DC (in 2nd line after WO). Why so ?

OS - Windows Server 2008 R2

  • can you run icacls on a file in foldera? – Louis Sep 23 '14 at 5:11
  • C:\folderA>icacls logcopy.py logcopy.py NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F) BUILTIN\Users:(I)(RX) Successfully processed 1 files; Failed processing 0 files. – Dhiwakar Ravikumar Sep 23 '14 at 5:29
  • I think these files were created by administrator so darth is unable to delete them, however Darth is able to delete files he created. I thought DC would've taken precedence here – Dhiwakar Ravikumar Sep 23 '14 at 5:30
1
+50

It can be achieved in different way by manipulating advanced permissions and permissions inheritance.

For example how I do it for user mmv and folder test

D:\empty\test>icacls .
VS2K8TS\mmv:(OI)(CI)(IO)(F)
VS2K8TS\mmv:(RX,W,DC)
BUILTIN\Administrators:(I)(OI)(CI)(F)
NT AUTHORITY\system:(I)(OI)(CI)(F)
CREATOR-OWNER:(I)(OI)(CI)(IO)(F)

I only add permissions for mmv. So mmv almost like admin in this folder but unable to delete folder itself.

Point attention, user (mmv) hawe two advanced acl records, for folder itself and for sub-folders and files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.