8

Is there a way I can set create file/folder permissions for a user in Windows 7 without giving delete permission for a folder?

I don't want the user to delete any files in that folder, but he should be able to make new files,rename them, and copy new files to that folder. Is this possible in Windows?

Improve this question
9
+50

You cannot disallow deletes and expect rename to work, as explained below.

Windows treats a file renaming operation as a deletion of the file and creation of a new file with the new name. Therefore, you absolutely must have one or both of the following two permissions:

  • Delete permission on the file itself, or
  • Delete Subfolders and Files permission on the folder that contains the file.

To complete the list, for renaming you require in addition the following permissions:

  • Write Data permission on the folder because of the new-file creation
  • Read Attributes permission to both the folder and the actual file
  • Synchronize permission to both the folder and the actual file
  • List Directory permission to the folder.

These permissions allow the rename command to check for the existence of the file and verify that the file's attributes (for example, the Read Only attribute) don't prevent the rename.

Improve this answer
  • Ok. Thanks for the information. Is it possible to make a service/program in C# that can prevent deletion of files for a particular user? – Jishnu U Nair Jan 9 '15 at 7:55
  • Yes you can : see for example. – harrymc Jan 9 '15 at 8:26
5

Right click the folder → Properties → Security → Advanced → Permissions → Change Permissions → <select user> → Edit. You can specify (deny) very detailed permissions in there, including the Delete permission

Enter image description here

BTW, don't use "CREATOR OWNER" (that was just an example). Use the actual user or group you wish to deny the permission to.

Improve this answer
  • I tried this, but when I try to modify a file it shows "No rights to modify contact Admin" – Jishnu U Nair Dec 23 '14 at 11:15
  • more specifically I cannot change the filename, even though I can create new files. – Jishnu U Nair Dec 23 '14 at 11:29
  • 1
    My answer [& anybody's] depends on you having the existing rights to modify the permissions - otherwise an admin would have to do it for you. & you cannot change what filename? – Tetsujin Dec 23 '14 at 11:31
  • BTW, don't use CREATOR OWNER, use the actual user or group you wish to deny the permission to. – Tetsujin Dec 23 '14 at 11:34
  • yes I know that, I used the proper usernames. Either way it doesn't help – Jishnu U Nair Dec 23 '14 at 11:35
2

What you write what you want is not possible. If a user wants to rename a file this requires the right to delete it (see Server Fault or WindowsIT Pro).

If it is OK for you that users can create new files in the folder and do with them whatever they want, but not mess with other files (like in a shared temp folder), you can change the permissions for the folder. In Windows Explorer, right click/properties on the folder, Permissions, Advanced, and change permissions. The required rights are:

"this folder, subfolders, files": "Read, Write, Execute" (search folder, list folder, read attributes. read extended attributes, create files, create folders, write attributes, write extended attributes) for the users in question.

"only subfolders and files": full access for "CREATOR OWNER".

Improve this answer
  • Hi .. the issue is according to Windows permissions, if delete permission is removed, user cannot add a new file and rename it, but what I want is to rename files but not delete them – Jishnu U Nair Jan 12 '15 at 12:47
  • @JishnuUNair I know. And that is exactly what I wrote: "If a user wants to rename a file this requires the right to delete it (see...)." – Werner Henze Jan 12 '15 at 12:48
0

Are you sure it is not already as you want it by design? If the users are not administrators they can create/delete THEIR OWN files, but they can ONLY read the files created there by other users. Isn't that enough?

The default NTFS permissions do just that. Create a folder as an administator and check the security on it - notice that Users have Read & Execute, List Folder Contents, Read and Special Permissions - which as you can see in advanced means Create files / Write Data, Create Folders / Append Data.

From what you described I think this is what you wanted ;)

Improve this answer
0

In the property dialog of the folder choose Advanced and then Change permissions.

There you can set differentiated rights. You can choose if the rights shall apply to folders, files, or both.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.