Hi Soheb Khan,

You can create a group policy to deny the delete permission on the folder. Open Group Policy Management Editor, navigate to Computer Configuration / Policies / Windows Settings / Security Settings / File System and set the user permissions in the advanced permissions.

Best Regards,

Ian Xue

If the Answer is helpful, please click "Accept Answer" and upvote it.

Some ways to prevent deletion:

• Modify ownership of the folder.
  • Right-clik the folder and select Properties.
  • On the Security tab, select Advanced.
  • On the Permissions tab, Disable inheritance, removing all inherited permissions.
  • This denies permission to do anything to that folder, until you assign an owner and set permissions for that owner. Of course, that owner should be able to delete the folder... so you might want to create a new user for that purpose.
• Use third-party software, such as TunesBro Folder Unbreak or an alternative. N.B. Check reviews and use VirsuTtoal to look for malware before installing any software.

Hi there

I have been going through forum regarding restricting people from deleting the files. But dont think i have found any solution yet.

I have a windows server, and would like to restrict people from deleting the files. Using NTFS permissions i know we cannot as they cannot modify either.

So can someone shed me some light on 3rd party softwares or tools please?

Thanks

In Windows a file generally gets its ACL from the folder in which it is created. If the folder allows non-owners of files to delete them, then they can even if the owner is an administrator.

As you note you can change this for a file, a folder or a folder tree.

To change for all folders you need to first identify which folder trees you want to change (e.g. you shouldn't start changing permissions of C:\Users, C:\Windows, ... and other system folders).

Then for each of these you need to modify the ACL. This can be done in code or script (e.g. PowerShell), but needs more time to write up than I have now (if you just want to copy one ACL to another folder you can get-acl on the first and then set-acl on the other).

However I would suggest you consider why you want to do this. If a user needs to create files that only they can delete the best route is to create a folder, with specific ACL, for that purpose. Not to make some global change so the administrator doesn't have to think.

I am trying to prevent users from accidentally deleting a certain folder in a parent folder, while still giving them modify permission on all other files and folders in the parent folder. But they should be also able to modify files and folders in this certain folder

Prevent Folder Deletion or inadvertent Drag and Drop with NTFS security

If you want to prevent a specific folder from being deleted or dragged and dropped elsewhere, even if it has elevated implicit permissions, you can set an explicit DENY to the FOLDER ONLY for the user account or security group which you want to prevent this action from being performed.

You can complete this folder security lock down using ICACLS with a local path (e.g C:\Path\FolderA\FolderE) or a UNC path (e.g \\server\share\FolderA\FolderE).

Example ICACLS syntax to run from an elevated command prompt

ICACLS "\\server\share\FolderA\FolderE" /deny "<UserOrGroupNameToDeny>":(DE)

Permissions Used

/deny user:permission
   Explicitly deny the specified user access rights.
   This will also remove any explicit grant of the 
   same permissions to the same user.

perm is a permission mask and can be specified in one of two forms:
   a comma-separated list in parentheses of specific rights:
         DE - delete

What this does

Running the above with those options in that syntax will set an explicit DENY to the NTFS DELETE permission on that FOLDER ONLY to that specific user account of security group.

You can confirm the deny permissions to the folder for the user account or security group by:

• right-click the folder you've used in the command,
• Select the Security tab,
• In the Group or user name: area scroll to or select and highlight the account or group you've used in the command,
• In the Permissions for Administrators area you will see the NTFS permission attributes for Allow and Deny
• You'll see a check mark in the DENY column of the special permissions row for the account or group you've used in the command

• Select Advanced and go to the Permissions tab
• Check for the Name (or Principal) value that you used in command, for DENY in the Type field
• The Permissions (or Access) field should show Delete and the Apply to (or Applies to) will show this folder only

NOTES

Please note that unchecking an ALLOW DELETE attribute is not the same as leaving that in place as-is and then creating a separate NTFS ACL rule for this same security group or user account saying to explicitly DENY the DELETE security.

This solution does NOT disallow DELETE this way

(WRONG)

This solution WILL explicitly DENY DELETE at this level to THIS FOLDER ONLY

(CORRECT)

(CORRECT)

Further Reading and Resources

• ICACLS

I'm still having a problem with this.  I understand the concept of permissions, but have not ever been able to use them effectively in Windows as it seems like the permissions are not mutually exclusive.  I still wish Windows was a bit more like Unix in this regard.  To summarize, I would like to eliminate the ability to delete or modify a photo, but still retain the ability to add tags.

My computer is set up with an Admin and a Std User account.  I tried 3 things:

1. Photo with Owner=Admin.  I went into permissions and denied "write".  From Std User account I am not able to add a tag, am not able to modify, but can still delete the file.
2. Photo with Owner=Admin.  I went into properties and selected "Read Only".  Same response as above.
3. Photo with Owner=Admin.  I am able to modify the tag, but still able to delete.

It seems like option 3 above should be the closest that I can get, but I thought you could not delete a file that belonged to a different owner.  Is this true?  What am I doing wrong?

Perhaps a 3rd party app is my best bet, but I was hoping I could do it with Windows 7.

Thanks.

https://serverfault.com/a/975978/601735

Jim Ryans's answer works perfect. In addition to his answer, if you want to prevent others delete the files you created, just add a "file only" "deny" and tick "Create Folders/Append Data".

Hi

as a starting point, I'm assuming the "Shared Drive" is the root drive thats mapped for all users via GPO, and you then have multiple departmental folders contained within that Shared Drive?

You need to go with the most restrictive approach that will also give your users functionality to perform their roles

My approach to this would be:

• Create Security Groups in Active Directory for each group of users.
• For Share Permissions on the Shared Folder, give each of the groups you created Full Control rights. Do not use "Everyone", "Domain Users" or "Authenticated Users".
• For NTFS Permissions on the Shared Folder, give each of the groups you created Read and Execute rights to "This folder only".
• For NTFS permissions under each subfolder, give each of the groups Modify rights at most to their respective folders and allow this for "This folder, subfolders and files". Never give Full Control, as this allows users to change permissions or add other users/groups to the NTFS permissions.

One thing to note on the NTFS permissions: you are likely top see "Authenticated Users" getting inherited "Read and Execute" access from the root folder on your server.

Click on "Disable inheritance", and select the option below (you'll still need Administrators, CREATOR OWNER and SYSTEM to have permissions):

You can then remove "Authenticated Users" and add your own set of permissions.

Hope this helps,

Thanks

Michael Durkan

• If the reply was helpful please upvote and/or accept as answer as this helps others in the community with similar questions. Thanks!

Edit the permissions (Right-click -> Properties -> Security) and remove the Delete permissions on both files and folders. Then make sure you enable permissions inheritance before you confirm the edits.

Usually when I get a request for this, it's because someone was stupid and deleted or moved folders they shouldn't have.

Read and write requires Delete as well for things like renaming or editing. The only options are to limit staff/groups to read only, have a quick backup option (like shadow copies) or use an auditing tool like Netwrix' file server auditor.

The key is that users can delete a file if the file's ACL entitles them to delete it or the containing directory's ACL gives them the delete-child permission. You need to make sure that this limited user doesn't get either permission. On the special folder from which they shouldn't be able to delete files, assign them the following permissions in the Advanced Security Settings window:

• Allow "traverse folder / execute file", "list folder / read data", "read attributes", "read extended attributes", "create files / write data", "create folders / append data", and "read permissions" on "this folder and subfolders"
• Deny "delete subfolders and files", "delete", and "change permissions" on "this folder, subfolders, and files"
• Allow full control on "files only" (this will be moderated by the previous deny rule)

But because this user is the owner of any files they create, they are entitled to change the permissions to allow deletion. The last piece of the puzzle is the arcane OWNER RIGHTS principal. You can type that phrase right into the user selection dialog where you would usually type the name of a user or group. Create one last rule on the folder that grants only "read permissions" on "subfolders and files only" to OWNER RIGHTS. Then the only advantage of being the owner of a file in that folder is that it guarantees ability to see the ACL, but not to change it.