Delete Subfolders and Files

R

richard

Hi all,

Could anyone clarify how the Delete Subfolders and Files permission
works?

Testing this on xp sp3 doesn't work as I'd expect:

UserA owns FolderA, and on that folder they have the 'Delete
Subfolders and Files' permission.

Inside FolderA is FolderB, owned by UserB. UserB has taken away all
rights from UserA to do anything with FolderB, including inherited
rights.

UserB creates FileB inside FolderB.

Now, UserA can see FileB inside FolderB, but cannot delete it.

Is that really the way it's supposed to behave?

Regards
Richard
 
B

Bruce Chambers

Hi all,

Could anyone clarify how the Delete Subfolders and Files permission
works?

Testing this on xp sp3 doesn't work as I'd expect:

UserA owns FolderA, and on that folder they have the 'Delete
Subfolders and Files' permission.

Inside FolderA is FolderB, owned by UserB. UserB has taken away all
rights from UserA to do anything with FolderB, including inherited
rights.

UserB creates FileB inside FolderB.

Now, UserA can see FileB inside FolderB, but cannot delete it.

Is that really the way it's supposed to behave?

Regards
Richard


Yes.

--

Bruce Chambers

Help us help you:


http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot
 
B

Bruce Chambers

Well, thanks for your reply Bruce, but that's not what it says in the
xp help:

'Delete Subfolders and Files
Allows or denies deleting subfolders and files, even if the Delete
permission has not been granted on the subfolder or file. (applies to
folders)'

That's exactly the situation here. UserB has not granted permission to
UserA to delete FileB, and indeed he can't, despite having 'Delete
Subfolders & Files' permission on a containing folder.

Is the help wrong, or is there some other way of interpreting what it
says?

Regards
Richard


You said that "UserB has taken away all rights from UserA to do
anything with FolderB, including inherited rights." Therefore, what
your seeing is exactly what it should be.


--

Bruce Chambers

Help us help you:


http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot
 
R

richard



Well, thanks for your reply Bruce, but that's not what it says in the
xp help:

'Delete Subfolders and Files
Allows or denies deleting subfolders and files, even if the Delete
permission has not been granted on the subfolder or file. (applies to
folders)'

That's exactly the situation here. UserB has not granted permission to
UserA to delete FileB, and indeed he can't, despite having 'Delete
Subfolders & Files' permission on a containing folder.

Is the help wrong, or is there some other way of interpreting what it
says?

Regards
Richard
 
R

richard

You said that "UserB has taken away all rights from UserA to do
anything with FolderB, including inherited rights." Therefore, what
your seeing is exactly what it should be.

I was supposing that if UserA had the 'Delete Subfolders and Files'
permission on FolderA, then that would be an irrevocable right they
would hold for any files or folders, nested at any depth, within
FolderA.

I though that this would be useful to prevent a situation where UserA
finds they cannot delete a folder they own because another user has
created files or folders within it and taken away UserA's rights to
delete those nested files or folders.

Maybe it just doesn't work that way....

Regards
Richard
 
Joined
Jun 1, 2010
Messages
1
Reaction score
0
Richard,

OK, here is the deal.

'Delete' is an ordinary permission that can apply to folders or files, and is inherited by default. If you have that permission on a folder, you can delete any file in it, unless someone blocked inheritance and removed your permission to delete it. To delete a folder you must have Delete permission on the folder and on every last item inside. If you try to delete a folder and just one item inside is blocked, Windows will give you an error message, and nothing will be deleted. It scans through the whole folder first before deleting anything.

'Delete Subfolders and Files' is a special permission that does not behave in an ordinary way. It is only assigned to, and inherited by, folders. When you have this permission on a folder, it has the effect of granting 'Delete' to any subfolder or file inside, and to files inside any subfolders that inherit 'Delete Subfolders and Files' from their parent, and so on. With this permission, you could delete a file without any explicit or inherited 'Delete' permission, or even if the owner explicitly assigned 'Deny Delete' to you! You can't even tell by looking at the file's permissions. This permission is implemented and enforced by the immediate containing folder.

There are some quirks and exceptions, but those are rare situations, and they only occur when trying to delete files or subfolders on a local drive.

'Delete Subfolders and Files' has been around since Windows NT; you just couldn't see it. It was granted with Full Control. The idea was to give some more power to a non-administrator folder owner to delete items other users might have moved into a folder he owns, where the folder owner is not assigned 'Delete' permission to those items. This will generally happen when a user moves something from one folder with different permissions to another on the same volume. If the ordinary users (who are not folder owners) cannot edit permissions on anything, and you don't ever block inheritance, then the 'Delete Subfolders and Files' permission for the folder owner can always provide the intended power. If the ordinary users can and choose to block inheritance and remove the owner's 'Delete Subfolders and Files' permission on a subfolder he drags into the owner's folder, as well as the 'Delete' permissions on the files inside, then the folder owner would have to get an Administrator to take ownership, and change permissions, to delete it.

Basically, the Windows online help does not make clear that 'Delete Subfolders and Files', unless allowed to be inherited, does not extend beyond the subfolders inside the folder on which it is applied.

Administrators will have this permission on any folder where they have Full Control, but they generally don't rely on it, because, by default, they can just take ownership and grant themselves Full Control to anything on the system.

So, in your case, you can see why User A cannot delete Folder B. If you did everything the same but did not create File B, then User A should be able to delete Folder B.

As for "User A can see File B," this is a bit confusing, because if all rights were removed for User A from Folder B (including List Folder), he should get "Access Denied" trying to open the window in Explorer, or possibly a blank window over the network. Can you check your settings, and test it again, and let us know?

Jeffrey Fox
J.D. Fox Micro
http://www.jdfoxmicro.com/
 
D

Don Phillipson

.. . .
I was supposing that if UserA had the 'Delete Subfolders and Files'
permission on FolderA, then that would be an irrevocable right they
would hold for any files or folders, nested at any depth, within FolderA.

Oh -- why?
 
J

John John - MVP

I was supposing that if UserA had the 'Delete Subfolders and Files'
permission on FolderA, then that would be an irrevocable right they
would hold for any files or folders, nested at any depth, within
FolderA.

No, explicit permissions take precedence over inherited permissions and
denied denied permissions take precedence over allowed permissions.

John
 
B

Bruce Chambers

On Wed, 02 Jun 2010 10:00:47 -0300, John John - MVP


So how does UserA deal with the situation I described, where they
cannot delete a folder they own because another user has
created files or folders within it and taken away UserA's rights to
delete those nested files or folders?

UserA, at this point, *cannot* do anything to deal with it, because
he/she allowed UserB Full Control within his/her purported area of
control. Only another user with administrative permissions to all of
the folders/sub-folders can now put things "right" by taking ownership
of the entire (from UserA's level down) folder tree.

Without 'Delete Subfolders and Files' working in the way I had
supposed, UserA's only option seems to be to involve an administrator,
asking them to take ownership and then delete the problem files &
folders.

That's correct. This is one reason why, in the normal scheme of
things, only administrators are permitted "Full Control." Normal users
should never be granted any privileges beyond "Modify."


--

Bruce Chambers

Help us help you:


http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot
 
R

richard

No, explicit permissions take precedence over inherited permissions and
denied denied permissions take precedence over allowed permissions.

John

So how does UserA deal with the situation I described, where they
cannot delete a folder they own because another user has
created files or folders within it and taken away UserA's rights to
delete those nested files or folders?

Without 'Delete Subfolders and Files' working in the way I had
supposed, UserA's only option seems to be to involve an administrator,
asking them to take ownership and then delete the problem files &
folders.

Regards
Richard
 
R

richard

That's correct. This is one reason why, in the normal scheme of
things, only administrators are permitted "Full Control." Normal users
should never be granted any privileges beyond "Modify."

ok.

Thank you for your help Bruce.

Regards
Richard
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top