Restrict folder permission to prevent from moving

[Fat Frog]

I am trying to set up a folder permission like this:

Regular uses are able to modify existing files and subfolders, create new
files or subfolders; but they should not be able to move the said folder,
because sometimes this folder was accidentally moved to somewhere else,
possibly due to a slippery mouse.

I had tried to take "modify" out of the permission list, this allows the
user to write new files, but will not allow to modify existing files. They
cannot even do "Save As".

Thanks and regards.
TL

[Richard Price]

Have you tried setting advanced permissions, removing replicated
permissions from the parent and setting the permissions so the user
has read/write/modify/delete etc only on objects within the container
- theres a tickbox at the bottom of the permissions screen which
allows you to specify that.

Richard

[Fat Frog]

Actually, I didn't uncheck "modify" from the permission list. I went to the
"advanced" setting and unchecked "delete". When this is done, "modify"
checkbox is cleared automatically.

Thanks and regards,
TL

"Richard Price" <richardprice@gmail.com> wrote in message
news:7dd0b405-efa3-4527-a8be-c5bad4711c88@y38g2000hsy.googlegroups.com...
> Have you tried setting advanced permissions, removing replicated
> permissions from the parent and setting the permissions so the user
> has read/write/modify/delete etc only on objects within the container
> - theres a tickbox at the bottom of the permissions screen which
> allows you to specify that.
>
> Richard

[David Shen [MSFT]]

Dear Customer,

Thank you for posting in newsgroup. And thanks to Richard for the
contribution.

According to the description, the issue seems to be related to NTFS
permission of folders and files. If I have any misunderstanding, please
feel free to let me know.

Based on the research, here is some information just for your reference.

Analysis and Suggestion:
=====================

If you want to modify existing files and subfolders and create new files or
subfolders, the Allowed "Modify" is needed to be selected in the ACL of the
folders. However, you don't wish the users be able to move these folders to
other location, in this way, the "Modify" NTFS permission should be "Deny"
in the ACL of the folders.

Please note: If you select "Modify" permission, this will include "traverse
Folder/Execute File", "List Folder/ Read Data", "Read Attributes", "Read
Extended Attributes", "Create Files/ Write Data", "Create Folder/ Append
Data", "Write Attributes", "Write Extended Attributes", "Delete" and "Read
permission"

Since you had tried to removed "modify" out of the permission list, this
allows the user to write new files, but will not allow to modify existing
files. Yes, that is right. However, based on the test, we can even do "Save
As" because the action of "Save As" is equal to create a new file in the
folder. In other word, I am afraid that the desired wish cannot be achieved
by the current design of NTFS permission. I would like to suggest that you
check if there is a third party tool can achieve the goal.

Hope the issue will be resolved soon.

Thanks for your understanding.

David Shen
Microsoft Online Partner Support

[IsraelC from Miami]

Hi David,
What about this scenario? I am looking to prevent users from deleting a MS
Word/Excel file within a folder share. I want to allow them to edit current
files and create new ones but NOT delete. I have tested by disabling or not
granting the delete folder/subfolder right BUT when users edit a Word or
Excel file the Word doc keeps the tmp files and the Excel file gives an error
that the folder is read only...any ideas?
Thank you

"David Shen [MSFT]" wrote:

> Dear Customer,
>
> Thank you for posting in newsgroup. And thanks to Richard for the
> contribution.
>
> According to the description, the issue seems to be related to NTFS
> permission of folders and files. If I have any misunderstanding, please
> feel free to let me know.
>
> Based on the research, here is some information just for your reference.
>
> Analysis and Suggestion:
> =====================
>
> If you want to modify existing files and subfolders and create new files or
> subfolders, the Allowed "Modify" is needed to be selected in the ACL of the
> folders. However, you don't wish the users be able to move these folders to
> other location, in this way, the "Modify" NTFS permission should be "Deny"
> in the ACL of the folders.
>
> Please note: If you select "Modify" permission, this will include "traverse
> Folder/Execute File", "List Folder/ Read Data", "Read Attributes", "Read
> Extended Attributes", "Create Files/ Write Data", "Create Folder/ Append
> Data", "Write Attributes", "Write Extended Attributes", "Delete" and "Read
> permission"
>
> Since you had tried to removed "modify" out of the permission list, this
> allows the user to write new files, but will not allow to modify existing
> files. Yes, that is right. However, based on the test, we can even do "Save
> As" because the action of "Save As" is equal to create a new file in the
> folder. In other word, I am afraid that the desired wish cannot be achieved
> by the current design of NTFS permission. I would like to suggest that you
> check if there is a third party tool can achieve the goal.
>
> Hope the issue will be resolved soon.
>
> Thanks for your understanding.
>
> David Shen
> Microsoft Online Partner Support
>
>

[David Shen [MSFT]]

Dear Customer,

Thanks for your reply.

For your concern about this scenario, here is some information just for
your reference.

Analysis and Suggestion:
======================

Unfortunately, I am afraid that the requirement could not be met because of
the way that Office saves files. When you modify and then save a Word
document, the following happens:

1. Word builds a new temporary file using the edited version of the
document.

2. After Word creates the temporary file, Word deletes the previous version
of the document.

3. Word renames the temporary file to the same name as the previous version
of the document.

According to the above work process, we can see that the Delete permission
is required to modify and save a Word document. In other word, if you
permit a user to save modification you will also need to permit a user to
delete the file. Unfortunately, this behavior is designed and could not be
modified. Thank you for your understanding.

For more information, please refer to the following Microsoft Knowledge
Base article:

A description of the way that Excel saves files
http://support.microsoft.com/kb/814068

You receive an error message when you try to save a file in Excel
http://support.microsoft.com/kb/214073/

WD: How Word for Windows Uses Temporary Files
http://support.microsoft.com/kb/211632

Hope it helps.

David Shen
Microsoft Online Partner Support

[David Shen [MSFT]]

Dear Customer,

How's everything going?

I'm wondering if the suggestion has helped or if you have any further
questions. Please feel free to respond to the newsgroups if I can assist
further.

David Shen
Microsoft Online Partner Support