1

I created a folder in my workplace's domain. I am not the Administrator, so if I set any restrictions for Everyone it applies to me too. If I create another set of permissions for Owner (me), the restrictions are overridden by the ones applied to Everyone.

Is it possible to set permissions for "everyone except owner"? I am ultimately trying to prevent anyone but me from deleting things from the folder.

  • If everyone is more permissive than owner then it doesn't matter, however everyone doesn't need more permission than owner if you are the owner. – Tyson Aug 28 '15 at 0:33
  • How do I make "everyone" less permissive than "owner"? It doesn't seem to be that way by default... – Mike Aug 28 '15 at 0:42
  • Do you have another account to test? There is no way to test what happening unless you can be everyone instead of owner. – Tyson Aug 28 '15 at 0:44
  • I do have another account to test – Mike Aug 28 '15 at 15:03
1

If I set any restrictions for "everyone", it applies to me too.

This is correct. Deny permissions always override allow permissions, regardless of the user or group to which they apply. The only way you could employ deny permissions to prevent "everyone but you" from deleting items from your folder would be to create a security group that every user account on the domain is a member of except you. Unless you have a very small domain this isn't feasible. The correct way to solve your problem is to not grant the unwanted permissions to other users in the first place.

I am ultimately trying to prevent anyone but me from deleting things from the folder.

Set your permissions as follows:

Everyone: Read & Execute
You: Full Control


If you literally want others to do everything except delete items from the folder (e.g. allow them to create items), in addition to granting yourself Full Control, set your permissions for the Everyone identity as follows:

  • Traverse folder / execute files
  • List folder / read data
  • Read attributes
  • Read extended attributes
  • Create files / write data
  • Create folders / append data
  • Write attributes
  • Write extended attributes
  • Read permissions
  • I don't quite follow. You seem to imply that I would HAVE to create a security group that includes everyone except me to accomplish what I want (which makes sense since deny overrides allow and I'm part of "everyone"). But below you give me directions for setting permissions without that special security group. – Mike Aug 28 '15 at 15:03
  • @Mike No, you would only have to create such a group if you insisted on using Deny permissions, which, as I noted Unless you have a very small domain this isn't feasible. I didn't give you those directions because that's an incredible obtuse way of solving the problem, made worse by the fact there's no way to dynamically manage that group's membership, i.e. when a new user is added to the network someone has to remember to add them to this "everyone but you" group. The solution I gave you is not only the best-practice approach, but once configured it's bullet-proof. – I say Reinstate Monica Aug 28 '15 at 15:11
  • But the solution you gave removed the ability to delete from everyone, which overrides full control for myself, right? I just tried it anyways and now my folder is invisible (or deleted, I don't know which). It's just a test folder though so it's not a big deal but I'm not sure why that happened. – Mike Aug 28 '15 at 15:18
  • Double post.. Tried it again (folder didn't get deleted this time) and as you implied above, I am unable to delete items I created in the folder. – Mike Aug 28 '15 at 15:24
  • 1
    Ohh I see what you meanow. I am unable to do that as only the admin has permission to change allow permissions for Everyone. I'll work things out with him about it. Thank you! – Mike Aug 28 '15 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.