NTFS Permissions to allow saving but prevent changing

[zoomlmk]

Hello, I'm trying to give a user access to save files into a folder but prevent them from changing it or changing any other files within that folder. Is this possible? Thanks for your help.

[Expertz]

You only need write permissions to overwrite/modify a file on NTFS. From a security perspective there is no difference between write and delete, the reality is that if a user can write to a file then they can delete its contents.

[zoomlmk]

Gotcha, so there is no real way to implement the permissions I'm trying to do then? Thanks.

[RedZot]

Give Read, Write and Read & Execute permission to the main folder for other users. Create another folder2 in that folder and keep other files in that folder2. Now to this folder2 give deny permissions for other users. I think this should do the trick. Verify yourself if it is providing as desired.

If you do not create folder2 in main folder, you will have to give deny permission to all files. So creating folder2 will make the task easy.

[zoomlmk]

Right, but the user in question would still be able to change files in "Folder2" wouldn't he?

Do you know of anything options, perhaps setting up an internal FTP site via ISS that points to the target folder, but allows only uploading?

Thanks.

[zoomlmk]

By pure luck I was able to figure this out and thought I'd share the solution with the rest of you.

To enable a user to save documents into a folder and read them, but prevent them from changing or modifying those documents in anyway, you have to create three ACLs for that user. They should include the follow:

ACL 1 - Folder (and subfolders) only - PERMIT Traverse Folder/Execute File, ListFolder/Read Data, Read Attributes, Read Extended Attributes, Create Files/Write Data, Read Permissions.

ACL 2 - Files Only - PERMIT Traverse Folder/Execute File, ListFolder/Read Data, Read Attributes, Read Extended Attributes, Read Permissions.

ACL 2 - Files Only - Deny Create Files/Write Data

Hope that made sense. Anyways it works great. Thanks for the help all.