Home / server / Questions / 939828
Accepted
Shaamaan
Asked: 2018-11-14 07:03:02 +0800 CST

Restrict modify / delete for "not my" files / folders on an NTFS share

  • 772

This question is, perhaps, slightly similar to this question, but the actual plan is different.

My goal is to create a "temp" share where people can off-load their data (for example, when they are getting ready to reinstall the OS or need to quickly share something with another employee).

Now, while a "temp" folder is by definition "temporary" and shouldn't be used for storing stuff long-term, I still want to maintain some security. To that end I'd like to grant my users (My.Domain\Domain Users) write access (create folders / files), and then modify / delete access only to the files / folders they, themselves, have created.

I suspect I'd need to make use of the "CREATOR OWNER" special principal. However, I feel that to restrict modify / delete capabilities, I'd need to explicitly add a deny permission to the NTFS security tab, and deny-rules, AFAIK, take precedent over allow-rules, so the CREATOR OWNER, even if granted full permission, wouldn't be able to actually make the changes.

Is what I'm trying to achieve at all possible?

network-share

1 Answers

  1. Best Answer

    Here's the misunderstanding:

    And if the "share" permissions allow writing, then users can still delete, even if that permission isn't explicitly allowed in the NTFS settings.

    The share permissions never give you the ability to override the NTFS permissions. In order to perform a given action, you must have permission for that action on both the share and in NTFS. What you're probably seeing is the effect of the "Delete Subfolders and Files" right as mentioned in the answers to the linked question: you can delete a file if you have either the "Delete" right on the file or the "Delete Subfolders and Files" right on the folder containing the file. (The behaviour when deleting a folder is slightly more complicated, but the essentials are the same.)

    The simplest way of resolving this problem is to give the users "Modify" on the parent folder rather than "Full Control".

    So you want the NTFS permissions on the folder being shared to look like this:

    • Domain Users - Modify, this folder only
    • CREATOR OWNER - Full Control, all subfolders and files
    • Domain Users - Read/Execute, all subfolders and files (assuming that you want users to be able to read other user's files by default)
    • Administrators - Full Control, all subfolders and files (so that you can delete stuff if it becomes necessary to do so, e.g., files belonging to a user that has left)
    • 2