Hi all,

Could anyone clarify how the Delete Subfolders and Files permission
works?

Testing this on xp sp3 doesn't work as I'd expect:

UserA owns FolderA, and on that folder they have the 'Delete
Subfolders and Files' permission.

Inside FolderA is FolderB, owned by UserB. UserB has taken away all
rights from UserA to do anything with FolderB, including inherited
rights.

UserB creates FileB inside FolderB.

Now, UserA can see FileB inside FolderB, but cannot delete it.

Is that really the way it's supposed to behave?

Regards
Richard

(E-Mail Removed) wrote:
> Hi all,
>
> Could anyone clarify how the Delete Subfolders and Files permission
> works?
>
> Testing this on xp sp3 doesn't work as I'd expect:
>
> UserA owns FolderA, and on that folder they have the 'Delete
> Subfolders and Files' permission.
>
> Inside FolderA is FolderB, owned by UserB. UserB has taken away all
> rights from UserA to do anything with FolderB, including inherited
> rights.
>
> UserB creates FileB inside FolderB.
>
> Now, UserA can see FileB inside FolderB, but cannot delete it.
>
> Is that really the way it's supposed to behave?
>
> Regards
> Richard


Yes.

--

Bruce Chambers

Help us help you:
http://www.catb.org/~esr/faqs/smart-questions.html

http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot

(E-Mail Removed) wrote:
> On Mon, 31 May 2010 15:33:57 -0600, Bruce Chambers
> <(E-Mail Removed)3t> wrote:
>
>> (E-Mail Removed) wrote:
>>> Hi all,
>>>
>>> Could anyone clarify how the Delete Subfolders and Files permission
>>> works?
>>>
>>> Testing this on xp sp3 doesn't work as I'd expect:
>>>
>>> UserA owns FolderA, and on that folder they have the 'Delete
>>> Subfolders and Files' permission.
>>>
>>> Inside FolderA is FolderB, owned by UserB. UserB has taken away all
>>> rights from UserA to do anything with FolderB, including inherited
>>> rights.
>>>
>>> UserB creates FileB inside FolderB.
>>>
>>> Now, UserA can see FileB inside FolderB, but cannot delete it.
>>>
>>> Is that really the way it's supposed to behave?
>>>
>>> Regards
>>> Richard
>>
>> Yes.
>
>
> Well, thanks for your reply Bruce, but that's not what it says in the
> xp help:
>
> 'Delete Subfolders and Files
> Allows or denies deleting subfolders and files, even if the Delete
> permission has not been granted on the subfolder or file. (applies to
> folders)'
>
> That's exactly the situation here. UserB has not granted permission to
> UserA to delete FileB, and indeed he can't, despite having 'Delete
> Subfolders & Files' permission on a containing folder.
>
> Is the help wrong, or is there some other way of interpreting what it
> says?
>
> Regards
> Richard
>
>
>
>
>


You said that "UserB has taken away all rights from UserA to do
anything with FolderB, including inherited rights." Therefore, what
your seeing is exactly what it should be.


--

Bruce Chambers

Help us help you:
http://www.catb.org/~esr/faqs/smart-questions.html

http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot

On Mon, 31 May 2010 15:33:57 -0600, Bruce Chambers
<(E-Mail Removed)3t> wrote:

>(E-Mail Removed) wrote:
>> Hi all,
>>
>> Could anyone clarify how the Delete Subfolders and Files permission
>> works?
>>
>> Testing this on xp sp3 doesn't work as I'd expect:
>>
>> UserA owns FolderA, and on that folder they have the 'Delete
>> Subfolders and Files' permission.
>>
>> Inside FolderA is FolderB, owned by UserB. UserB has taken away all
>> rights from UserA to do anything with FolderB, including inherited
>> rights.
>>
>> UserB creates FileB inside FolderB.
>>
>> Now, UserA can see FileB inside FolderB, but cannot delete it.
>>
>> Is that really the way it's supposed to behave?
>>
>> Regards
>> Richard
>
>
> Yes.


Well, thanks for your reply Bruce, but that's not what it says in the
xp help:

'Delete Subfolders and Files
Allows or denies deleting subfolders and files, even if the Delete
permission has not been granted on the subfolder or file. (applies to
folders)'

That's exactly the situation here. UserB has not granted permission to
UserA to delete FileB, and indeed he can't, despite having 'Delete
Subfolders & Files' permission on a containing folder.

Is the help wrong, or is there some other way of interpreting what it
says?

Regards
Richard

On Mon, 31 May 2010 17:04:53 -0600, Bruce Chambers
<(E-Mail Removed)3t> wrote:

>(E-Mail Removed) wrote:
>> On Mon, 31 May 2010 15:33:57 -0600, Bruce Chambers
>> <(E-Mail Removed)3t> wrote:
>>
>>> (E-Mail Removed) wrote:
>>>> Hi all,
>>>>
>>>> Could anyone clarify how the Delete Subfolders and Files permission
>>>> works?
>>>>
>>>> Testing this on xp sp3 doesn't work as I'd expect:
>>>>
>>>> UserA owns FolderA, and on that folder they have the 'Delete
>>>> Subfolders and Files' permission.
>>>>
>>>> Inside FolderA is FolderB, owned by UserB. UserB has taken away all
>>>> rights from UserA to do anything with FolderB, including inherited
>>>> rights.
>>>>
>>>> UserB creates FileB inside FolderB.
>>>>
>>>> Now, UserA can see FileB inside FolderB, but cannot delete it.
>>>>
>>>> Is that really the way it's supposed to behave?
>>>>
>>>> Regards
>>>> Richard
>>>
>>> Yes.
>>
>>
>> Well, thanks for your reply Bruce, but that's not what it says in the
>> xp help:
>>
>> 'Delete Subfolders and Files
>> Allows or denies deleting subfolders and files, even if the Delete
>> permission has not been granted on the subfolder or file. (applies to
>> folders)'
>>
>> That's exactly the situation here. UserB has not granted permission to
>> UserA to delete FileB, and indeed he can't, despite having 'Delete
>> Subfolders & Files' permission on a containing folder.
>>
>> Is the help wrong, or is there some other way of interpreting what it
>> says?
>>
>> Regards
>> Richard
>>
>>
>>
>>
>>
>
>
> You said that "UserB has taken away all rights from UserA to do
>anything with FolderB, including inherited rights." Therefore, what
>your seeing is exactly what it should be.

I was supposing that if UserA had the 'Delete Subfolders and Files'
permission on FolderA, then that would be an irrevocable right they
would hold for any files or folders, nested at any depth, within
FolderA.

I though that this would be useful to prevent a situation where UserA
finds they cannot delete a folder they own because another user has
created files or folders within it and taken away UserA's rights to
delete those nested files or folders.

Maybe it just doesn't work that way....

Regards
Richard

[beakt]

Richard,

OK, here is the deal.

'Delete' is an ordinary permission that can apply to folders or files, and is inherited by default. If you have that permission on a folder, you can delete any file in it, unless someone blocked inheritance and removed your permission to delete it. To delete a folder you must have Delete permission on the folder and on every last item inside. If you try to delete a folder and just one item inside is blocked, Windows will give you an error message, and nothing will be deleted. It scans through the whole folder first before deleting anything.

'Delete Subfolders and Files' is a special permission that does not behave in an ordinary way. It is only assigned to, and inherited by, folders. When you have this permission on a folder, it has the effect of granting 'Delete' to any subfolder or file inside, and to files inside any subfolders that inherit 'Delete Subfolders and Files' from their parent, and so on. With this permission, you could delete a file without any explicit or inherited 'Delete' permission, or even if the owner explicitly assigned 'Deny Delete' to you! You can't even tell by looking at the file's permissions. This permission is implemented and enforced by the immediate containing folder.

There are some quirks and exceptions, but those are rare situations, and they only occur when trying to delete files or subfolders on a local drive.

'Delete Subfolders and Files' has been around since Windows NT; you just couldn't see it. It was granted with Full Control. The idea was to give some more power to a non-administrator folder owner to delete items other users might have moved into a folder he owns, where the folder owner is not assigned 'Delete' permission to those items. This will generally happen when a user moves something from one folder with different permissions to another on the same volume. If the ordinary users (who are not folder owners) cannot edit permissions on anything, and you don't ever block inheritance, then the 'Delete Subfolders and Files' permission for the folder owner can always provide the intended power. If the ordinary users can and choose to block inheritance and remove the owner's 'Delete Subfolders and Files' permission on a subfolder he drags into the owner's folder, as well as the 'Delete' permissions on the files inside, then the folder owner would have to get an Administrator to take ownership, and change permissions, to delete it.

Basically, the Windows online help does not make clear that 'Delete Subfolders and Files', unless allowed to be inherited, does not extend beyond the subfolders inside the folder on which it is applied.

Administrators will have this permission on any folder where they have Full Control, but they generally don't rely on it, because, by default, they can just take ownership and grant themselves Full Control to anything on the system.

So, in your case, you can see why User A cannot delete Folder B. If you did everything the same but did not create File B, then User A should be able to delete Folder B.

As for "User A can see File B," this is a bit confusing, because if all rights were removed for User A from Folder B (including List Folder), he should get "Access Denied" trying to open the window in Explorer, or possibly a blank window over the network. Can you check your settings, and test it again, and let us know?

Jeffrey Fox
J.D. Fox Micro
http://www.jdfoxmicro.com/

<(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> On Mon, 31 May 2010 17:04:53 -0600, Bruce Chambers
> >>>> Could anyone clarify how the Delete Subfolders and Files permission
> >>>> works?
.. . .
> I was supposing that if UserA had the 'Delete Subfolders and Files'
> permission on FolderA, then that would be an irrevocable right they
> would hold for any files or folders, nested at any depth, within FolderA.

Oh -- why?

--
Don Phillipson
Carlsbad Springs
(Ottawa, Canada)

(E-Mail Removed) wrote:
> On Mon, 31 May 2010 17:04:53 -0600, Bruce Chambers
> <(E-Mail Removed)3t> wrote:
>
>> (E-Mail Removed) wrote:
>>> On Mon, 31 May 2010 15:33:57 -0600, Bruce Chambers
>>> <(E-Mail Removed)3t> wrote:
>>>
>>>> (E-Mail Removed) wrote:
>>>>> Hi all,
>>>>>
>>>>> Could anyone clarify how the Delete Subfolders and Files permission
>>>>> works?
>>>>>
>>>>> Testing this on xp sp3 doesn't work as I'd expect:
>>>>>
>>>>> UserA owns FolderA, and on that folder they have the 'Delete
>>>>> Subfolders and Files' permission.
>>>>>
>>>>> Inside FolderA is FolderB, owned by UserB. UserB has taken away all
>>>>> rights from UserA to do anything with FolderB, including inherited
>>>>> rights.
>>>>>
>>>>> UserB creates FileB inside FolderB.
>>>>>
>>>>> Now, UserA can see FileB inside FolderB, but cannot delete it.
>>>>>
>>>>> Is that really the way it's supposed to behave?
>>>>>
>>>>> Regards
>>>>> Richard
>>>> Yes.
>>>
>>> Well, thanks for your reply Bruce, but that's not what it says in the
>>> xp help:
>>>
>>> 'Delete Subfolders and Files
>>> Allows or denies deleting subfolders and files, even if the Delete
>>> permission has not been granted on the subfolder or file. (applies to
>>> folders)'
>>>
>>> That's exactly the situation here. UserB has not granted permission to
>>> UserA to delete FileB, and indeed he can't, despite having 'Delete
>>> Subfolders & Files' permission on a containing folder.
>>>
>>> Is the help wrong, or is there some other way of interpreting what it
>>> says?
>>>
>>> Regards
>>> Richard
>>>
>>>
>>>
>>>
>>>
>>
>> You said that "UserB has taken away all rights from UserA to do
>> anything with FolderB, including inherited rights." Therefore, what
>> your seeing is exactly what it should be.
>
> I was supposing that if UserA had the 'Delete Subfolders and Files'
> permission on FolderA, then that would be an irrevocable right they
> would hold for any files or folders, nested at any depth, within
> FolderA.

No, explicit permissions take precedence over inherited permissions and
denied denied permissions take precedence over allowed permissions.

John

(E-Mail Removed) wrote:
> On Wed, 02 Jun 2010 10:00:47 -0300, John John - MVP
>
>> No, explicit permissions take precedence over inherited permissions and
>> denied denied permissions take precedence over allowed permissions.
>>
>> John
>
> So how does UserA deal with the situation I described, where they
> cannot delete a folder they own because another user has
> created files or folders within it and taken away UserA's rights to
> delete those nested files or folders?
>

UserA, at this point, *cannot* do anything to deal with it, because
he/she allowed UserB Full Control within his/her purported area of
control. Only another user with administrative permissions to all of
the folders/sub-folders can now put things "right" by taking ownership
of the entire (from UserA's level down) folder tree.


> Without 'Delete Subfolders and Files' working in the way I had
> supposed, UserA's only option seems to be to involve an administrator,
> asking them to take ownership and then delete the problem files &
> folders.
>

That's correct. This is one reason why, in the normal scheme of
things, only administrators are permitted "Full Control." Normal users
should never be granted any privileges beyond "Modify."


--

Bruce Chambers

Help us help you:
http://www.catb.org/~esr/faqs/smart-questions.html

http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot

On Wed, 02 Jun 2010 10:00:47 -0300, John John - MVP
<(E-Mail Removed)> wrote:

>(E-Mail Removed) wrote:
>> On Mon, 31 May 2010 17:04:53 -0600, Bruce Chambers
>> <(E-Mail Removed)3t> wrote:
>>
>>> (E-Mail Removed) wrote:
>>>> On Mon, 31 May 2010 15:33:57 -0600, Bruce Chambers
>>>> <(E-Mail Removed)3t> wrote:
>>>>
>>>>> (E-Mail Removed) wrote:
>>>>>> Hi all,
>>>>>>
>>>>>> Could anyone clarify how the Delete Subfolders and Files permission
>>>>>> works?
>>>>>>
>>>>>> Testing this on xp sp3 doesn't work as I'd expect:
>>>>>>
>>>>>> UserA owns FolderA, and on that folder they have the 'Delete
>>>>>> Subfolders and Files' permission.
>>>>>>
>>>>>> Inside FolderA is FolderB, owned by UserB. UserB has taken away all
>>>>>> rights from UserA to do anything with FolderB, including inherited
>>>>>> rights.
>>>>>>
>>>>>> UserB creates FileB inside FolderB.
>>>>>>
>>>>>> Now, UserA can see FileB inside FolderB, but cannot delete it.
>>>>>>
>>>>>> Is that really the way it's supposed to behave?
>>>>>>
>>>>>> Regards
>>>>>> Richard
>>>>> Yes.
>>>>
>>>> Well, thanks for your reply Bruce, but that's not what it says in the
>>>> xp help:
>>>>
>>>> 'Delete Subfolders and Files
>>>> Allows or denies deleting subfolders and files, even if the Delete
>>>> permission has not been granted on the subfolder or file. (applies to
>>>> folders)'
>>>>
>>>> That's exactly the situation here. UserB has not granted permission to
>>>> UserA to delete FileB, and indeed he can't, despite having 'Delete
>>>> Subfolders & Files' permission on a containing folder.
>>>>
>>>> Is the help wrong, or is there some other way of interpreting what it
>>>> says?
>>>>
>>>> Regards
>>>> Richard
>>>>
>>>>
>>>>
>>>>
>>>>
>>>
>>> You said that "UserB has taken away all rights from UserA to do
>>> anything with FolderB, including inherited rights." Therefore, what
>>> your seeing is exactly what it should be.
>>
>> I was supposing that if UserA had the 'Delete Subfolders and Files'
>> permission on FolderA, then that would be an irrevocable right they
>> would hold for any files or folders, nested at any depth, within
>> FolderA.
>
>No, explicit permissions take precedence over inherited permissions and
>denied denied permissions take precedence over allowed permissions.
>
>John

So how does UserA deal with the situation I described, where they
cannot delete a folder they own because another user has
created files or folders within it and taken away UserA's rights to
delete those nested files or folders?

Without 'Delete Subfolders and Files' working in the way I had
supposed, UserA's only option seems to be to involve an administrator,
asking them to take ownership and then delete the problem files &
folders.

Regards
Richard