Deny users the right to move folders and files?

[Guest]

I'm wondering if there is a way to deny users the ability to move folders and
files in and out of My Documents, etc. I'm having a problem with users
getting a little "click happy" and they accidentally move files so neither
they, nor the programs that use them, can find them. Is there some sort of
gpo to prevent this, or maybe something I can do at the local machine? These
files aren't necessarily shared files...just local files.

Thanks!
Lauren

 

[Steven L Umbach]

Move is a copy and delete action so you can do that by giving the user deny
permission for delete folders and or files but most likely that will cause
other problems in that users usually need to delete at least files. More
training and reminders may be a better solution and also using search to
find the files/folders by filename or extension.

Steve

 

[Guest]

I definitely see how that would work, and it's a good idea, however, we have
a program that creates files in these folders that need to be deleted
afterwards. Perhaps more training is the best way to go, but if anyone has
any other ideas, I'd appreciate it.

Thanks.

 

[karl levinson, mvp]

I agree with Steven. This is the only way. [Unless you wanted to implement
DRM, which may be too complex for this need.]

Without delete rights, users can still copy files to other locations. But
then apps like Microsoft Office that store temp files in the same directory
will start filling up the folder with temp files that cannot be deleted, if
you removed delete permissions from the entire folder.

You could choose to remove the delete permission only from existing files,
so that any new files could still be deleted.

Or, you could grant the delete permission to "Owner" so that users can only
delete or move files that they created themselves. Those might be possible
solutions?

If the program that creates files runs as a different account [for example
if it runs on a server rather than on each user's workstation], then you
could allow that account to retain delete permission.

 

[Steven L Umbach]

If it would help you can prevent deleting of folders only or individual
folder only by using special permissions as shown in the advanced page of
security properties where a user/group can be listed more than once of all
the possibilities in the "apply" onto box. For instance you could edit the
permissions for a folder by granting deny for the two delete permissions and
the select "this folder only". The link below explains special permissions
in more detail which give tremendous flexibility in assigning permissions.

Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;308419