controlling deleting of files with NTFS

controlling deleting of files with NTFS

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
controlling deleting of files with NTFS Chad Shutts 06-27-2007
Posted by =?Utf-8?B?Q2hhZCBTaHV0dHM=?= on June 27, 2007, 12:50 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I am trying to control the deleting of files in one of our deparments. Only
one user should be able to delete. Everyone else should be able to change,
and create new but never delete.

On the top most folder I am trying to set the ntfs security on, I have said
to 'deny' delete for the ACL group.

Ok, here is the issue: They are not allowed to delete, so I had sucess there!
They are allowed to modify, so I had success there!...but if they are in
word and create a new document and save it in that folder, they get an error
saying it cannot save because "the folder is marked read only".
If I go to the folder and right click, new, text document or word
document..I get a similiar message.

So I take away the deny delete and they can create new again...but they can
also delete files again.

I need to resolve this...but also their supervisor still needs to be able to
delete and she is in the same group.

So really I need answer to 2 questions...
1. prohibit the deleting of files
2. allowing one person to delete in the same folder

I appreciate any and all advice,
Chad

Posted by on June 27, 2007, 5:11 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
You may want to reconsider your folder permission architecture. First,
as you are seeing, it is unusual enough to cause issues with
applications. Second, insofar as protecting data, it will not prevent
users from erasing the data from the files. People will still be able
to delete the content if not the file.

The symptom you are seeing is caused by renaming a file. Basically,
when a file is created, it is created as "New Microsoft Word
Document.doc" and then the rename function is called. The person types
in the name and Windows renames the document. This hits the delete ACL
and thus causes the error.

You could get around this by having users create new documents in
Word, and save them with the name to this folder. You will then run
into another problem, however. Word creates several temporary files
when working on documents. It will be unable to clean up after itself
and thus these tmp files will accumulate over time.

Regards,

J Wolfgang Goerlich


On Jun 27, 12:50 pm, Chad Shutts
> I am trying to control the deleting of files in one of our deparments. Only
> one user should be able to delete. Everyone else should be able to change,
> and create new but never delete.
>
> On the top most folder I am trying to set the ntfs security on, I have said
> to 'deny' delete for the ACL group.
>
> Ok, here is the issue: They are not allowed to delete, so I had sucess there!
> They are allowed to modify, so I had success there!...but if they are in
> word and create a new document and save it in that folder, they get an error
> saying it cannot save because "the folder is marked read only".
> If I go to the folder and right click, new, text document or word
> document..I get a similiar message.
>
> So I take away the deny delete and they can create new again...but they can
> also delete files again.
>
> I need to resolve this...but also their supervisor still needs to be able to
> delete and she is in the same group.
>
> So really I need answer to 2 questions...
> 1. prohibit the deleting of files
> 2. allowing one person to delete in the same folder
>
> I appreciate any and all advice,
> Chad



Posted by =?Utf-8?B?Q2hhZCBTaHV0dHM=?= on June 28, 2007, 9:06 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks for the reply..

In your third paragraph..you said: You could get around this by having users
create new documents in Word, and save them with the name to this folder

in my original post I mentioned: "but if they are "-- in --"
word and create a new document and save it in that folder, they get an error
saying it cannot save because "the folder is marked read only".


"jwgoerlich@gmail.com" wrote:

> You may want to reconsider your folder permission architecture. First,
> as you are seeing, it is unusual enough to cause issues with
> applications. Second, insofar as protecting data, it will not prevent
> users from erasing the data from the files. People will still be able
> to delete the content if not the file.
>
> The symptom you are seeing is caused by renaming a file. Basically,
> when a file is created, it is created as "New Microsoft Word
> Document.doc" and then the rename function is called. The person types
> in the name and Windows renames the document. This hits the delete ACL
> and thus causes the error.
>
> You could get around this by having users create new documents in
> Word, and save them with the name to this folder. You will then run
> into another problem, however. Word creates several temporary files
> when working on documents. It will be unable to clean up after itself
> and thus these tmp files will accumulate over time.
>
> Regards,
>
> J Wolfgang Goerlich
>
>
> On Jun 27, 12:50 pm, Chad Shutts
> > I am trying to control the deleting of files in one of our deparments. Only
> > one user should be able to delete. Everyone else should be able to change,
> > and create new but never delete.
> >
> > On the top most folder I am trying to set the ntfs security on, I have said
> > to 'deny' delete for the ACL group.
> >
> > Ok, here is the issue: They are not allowed to delete, so I had sucess
there!
> > They are allowed to modify, so I had success there!...but if they are in
> > word and create a new document and save it in that folder, they get an error
> > saying it cannot save because "the folder is marked read only".
> > If I go to the folder and right click, new, text document or word
> > document..I get a similiar message.
> >
> > So I take away the deny delete and they can create new again...but they can
> > also delete files again.
> >
> > I need to resolve this...but also their supervisor still needs to be able to
> > delete and she is in the same group.
> >
> > So really I need answer to 2 questions...
> > 1. prohibit the deleting of files
> > 2. allowing one person to delete in the same folder
> >
> > I appreciate any and all advice,
> > Chad
>
>
>

Posted by on June 28, 2007, 1:32 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Well, I retract that statement then. I did some more testing.

What version of Office are you running? Word XP works as per my
original response. Word 2003 does, too. I tested Word 2007 and
received an "Access denied. Contact your administrator." dialog box.
It seems that some versions of Word will work and others will not.

Either way, this deny-delete ACL is not one that Office plays nicely
with.

Regards,

J Wolfgang Goerlich

wrote:
> in my original post I mentioned: "but if they are "-- in --"
> word and create a new document and save it in that folder, they get an error
> saying it cannot save because "the folder is marked read only".


Posted by =?Utf-8?B?Q2hhZCBTaHV0dHM=?= on June 28, 2007, 1:52 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
actually it really doesn't matter what version of office...because notepad
acts the same way but with a different error; if I go into notepad...type
something..then try to save to the folder I am testing with it tells me that
'this file is on a network drive with create but no modify privileges'.
...which is funny...because I can't create...but if a txt file already exist
I can modify it with no problems.

I don't think Windows likes to play with its own technologies.

"jwgoerlich@gmail.com" wrote:

> Well, I retract that statement then. I did some more testing.
>
> What version of Office are you running? Word XP works as per my
> original response. Word 2003 does, too. I tested Word 2007 and
> received an "Access denied. Contact your administrator." dialog box.
> It seems that some versions of Word will work and others will not.
>
> Either way, this deny-delete ACL is not one that Office plays nicely
> with.
>
> Regards,
>
> J Wolfgang Goerlich
>
> wrote:
> > in my original post I mentioned: "but if they are "-- in --"
> > word and create a new document and save it in that folder, they get an error
> > saying it cannot save because "the folder is marked read only".
>
>

Similar ThreadsPosted
Why am I deleting these files June 12, 2008, 9:36 am
Deleting TEMP files in C:\ April 1, 2006, 4:46 am
Stop Users Deleting and Moving Files June 16, 2006, 10:21 am
How to prevent users from deleting Word/Excel files in a Share? May 14, 2008, 9:45 pm
Enum only files/folders where explicit NTFS rights have been sette December 20, 2006, 3:47 pm
Controlling access to IIS web sites June 28, 2007, 2:17 pm
Problems deleting Certificate January 15, 2006, 3:51 pm
deleting security updates August 12, 2006, 2:22 pm
Unknown source deleting data January 4, 2006, 4:35 am
Deleting Archived Certificates from Users' My store on Workstations July 8, 2008, 3:50 pm

The site map in XML format XML site map

Contact Us | Privacy Policy