Some ways to prevent deletion:

• Modify ownership of the folder.
  • Right-clik the folder and select Properties.
  • On the Security tab, select Advanced.
  • On the Permissions tab, Disable inheritance, removing all inherited permissions.
  • This denies permission to do anything to that folder, until you assign an owner and set permissions for that owner. Of course, that owner should be able to delete the folder... so you might want to create a new user for that purpose.
• Use third-party software, such as TunesBro Folder Unbreak or an alternative. N.B. Check reviews and use VirsuTtoal to look for malware before installing any software.

Hi Shawn,

Thanks for the note.  Where is the "delete" permission?  Is that the same as the "write" permission?

Thanks.

It would be best to create an explicit deny ACE for the folder telling Windows a user or group cannot delete the folder itself.

Right-click the folder → Properties → Security → Advanced then click Add. In the Permission Entry window for your folder, click Select a principal.

Next, in the Select User and Group window, in the text box, enter the user's name (yours in this case) and press ENTER.

Change type to Deny and select Show advanced permissions, click Clear All, then check Delete.

Now click Ok in the Permissions Entry window, then click Ok again in the Advanced Security window, before finally click Ok one last time in the folder properties window.

Now right-click the folder → Delete. A popup should appear telling you you cannot delete the folder without modifying the permissions.

Note, however, the only disadvantage to this is that you cannot open the folder in File Explorer without agreeing to modifying the permissions. You can beforehand create the subfolders inside of it before you do this or you can access and create the file and folders through the command line if they do not exist yet.

Hi Soheb Khan,

You can create a group policy to deny the delete permission on the folder. Open Group Policy Management Editor, navigate to Computer Configuration / Policies / Windows Settings / Security Settings / File System and set the user permissions in the advanced permissions.

Best Regards,

Ian Xue

If the Answer is helpful, please click "Accept Answer" and upvote it.

Under NTFS you can alter the access rights for users and groups either at a folder level or at a file level.

Right click on a file or folder and go to the security tab. You can then remove users rights for deleting / modifying a file. Ensure you leave the administrator and administrators full rights. Also, if it on a domain ensure that both the local administrator and domain administrators have full access rights.

Due to accidental folder deletion happening too often we’d like to set up folder permissions on the server so that users cannot delete folders/subfolders or files (that they did not create). Two people have been assigned to maintain folders and they can delete and they will be assigned to a special group with those permissions. Looking at the permissions available, this seemed like it would be easy. For example, for the main group who cannot delete would this not seem reasonable NTFS permissions:

I tried it like this and users could still delete folders. I tried unchecking the ‘Delete’ and then users could not rename files or update files.

How would you assign permissions to this group so that they can create and update files, create folders but not be able to delete folders and files (that they did not create).

Thank you

You can accomplished with a little work.

• Right click the folder you want to prevent deletion and select Properties.

• While on the Security tab, click the Advanced button.

• Select your user in Permissions tab dialog.

• Select the Disable Inheritance

• Then select Convert Inherited Permissions...

• Then double-click your user name

• Click Show advanced permissions on the right side

• Uncheck Delete and click OK then Apply

You can no longer delete those files, but you can still modify them. Obviously, if these files are important, you should be making backups.

As a rule of thumb, you should avoid explicit DENY rules in ACLs. If one is required, it is often because the data is already structured wrong.

The ability to delete or rename a folder is not decided by the Delete permissions on the folder in question, but by the Delete subfolders and files permission on the parent folder. This is counter-intuitive and different from how permissions for a file work. It definitely doesn't work as you would expect.

Let's use the following folder / file structure as an example:

FolderA
    File1
    FolderB
        File2
        FolderC
            File3

FolderB and File1 are in parent FolderA. FolderC and File2 are in parent FolderB and so on.

Now, if we remove the Delete permission from File1, File2, or File3, for any user, that user will be prevented from renaming and deleting the file. This is also true if you use an explicit DENY Delete on the file.

However, if you remove the Delete permission from FolderA, FolderB, or FolderC, for any user, that user will still be able to rename and delete the folder. This is also true if you use an explicit DENY Delete on the folder.

Why is that? Because the Delete permission is a permission that applies to files, not folders. Instead, we must remove the Delete subfolders and files permission from the parent folder to accomplish what you are asking.

In our above example, we will need to remove the Delete subfolders and files permission from FolderA, for a particular user, assigning the permission to this folder only. In that case, the user will then be unable to modify FolderB and File1. The same is true if you use an explicit DENY Delete subfolders and files on FolderA instead.

The user can still rename and delete FolderA unless the parent of FolderA has also restricted that permission. As long as you applied the permission to this folder only then the user will continue to be able to read/write/modify File2, FolderC and File3.

The obvious drawback here is that it takes 2 levels of folders to accomplish what you are asking. In your case, you mention that you are trying to protect a Dropbox folder. So, your folder structure would have to look like this:

Dropbox
    Protected Folders
        File1
        File2
        FolderA
    Protected Files

You would remove, for a particular user or group, the Delete subfolders and files permission for this folder only on the Dropbox folder. You would then add or maintain, for a particular user or group, Full Control or Modify permissions for subfolders and files on the Dropbox folder.

Now the affected user will be unable to modify any files or folders immediately below the Dropbox folder, but will be able to modify all files and folders contained in any subfolders.

There is an additional concern here with Dropbox, because this is not a normal folder. The Dropbox application expects full control of the Dropbox folder. Being that Dropbox often runs as the logged on user, you can't prevent the logged on user from having full control of the Dropbox folder. You can try it, but the results may be unpredictable and chaos is likely to ensue.