Home / server / Questions / 59445
Accepted
user14930
Asked: 2009-08-28 00:57:21 +0800 CST

How to restrict users moving folders?

  • 772

We have the following layout

•Shared Folder "Clients"

•Level 1 ("Client A"/"ClientB"/"Client C"/etc)

•Level 2 ("Folder 1"/"Folder 2"/"Folder 3"/"Folder4")

•Level 3 ("Word Docs / Spreadsheets / Raw Data / etc")

Users have a mapped drive and access the folders as follows: Clients on server T:\Client A\Folder 1\Word Doc1.doc Each Client folder has 4 sub folders at level 2 as shown above.

The problem we have is users are accidentally saving/moving/deleting folders at Level 1 and Level 2.

We have a group called Admin Staff who are the users who create the folders at Level 1 and Level 2 when a new client is added onto the system. These users need to create / delete / ammend all details at all levels.

All other users for example Domain Users must not be able to make any changes to Level 1 or Level 2 folders. However they must be able to work within the various folders at Level 3. At level 3 the users can create their own sub folder structure if they like and we are happy for all users to have read/write/modify at this level.

What is the best way to configure network permissions to achieve this task to prevent users moving folders by mistake or deleting client folders.

Thanks

windows-server-2003 networking network-share file-permissions

5 Answers

  1. We have one folder that was constantly getting moved on accident into a neighboring folders, so we created a hidden folder called '~Anchor' that users don't have rights to do anything with. This seems to be the first thing that the system attempts to move and so it prevents any other part of the folder tree from being moved. Yet, still leaving users the ability to rename and move all the sub folders and files around if they need to.

    • 3
  2. Best Answer

    This is what I would do:

    Level 1 & 2 - Admin Group - Write, Modify, Read, etc. Users - Read, List Folder Contents, Read and execute

    Bottom levels - Users - add Write and Modify permissions.

    You can add permissions at the lower levels w/ no problems. Taking away permissions at lower levels is where you have to remove the inheritance and then copy permissions, then remove what you don't want.

    • 2

  3. It is much better to deny the delete privilege for the target users, since "Modify" permissions imply "Delete", which is what happens when you move the directory.

    This is significantly faster and easier (instead of the GUI) if you use the Xcacls.vbs tool. The command might look something like this:

    cscript xcacls.vbs "<target_directory>" /e /d "<domain\username>":;A

cscript xcacls.vbs "D:\Level1\Level2a" /e /d "MyDomain\LUsers":;A

    The options I chose include the "This folder and subfolders only", so it will not inherit to prevent people from deleting or moving files, but you will want to run the command for each directory you want to protect.

    • 2

  4. You'll have to create a read-only ACL on the top-level folder itself and remove inheritance/propagation, then read-write to it's contents and possible sub-folders. Sounds like a mess. Good luck.

    • 1

  5. If your users are anything like ours, the most likely cause of accidental moves is inadvertent clumsiness during drag and drop operations. Maybe some tuning of the DragHeight and Dragwidth settings under HKCU\Control Panel\Desktop might be a less radical solution?

    • 0