The keys you're missing are the CREATOR OWNER
identity and the "Apply To" setting.
Apply the following permissions to your shared folder to allow the Everyone
identity to create files & folders, but only a file or folder's* owner (CREATOR OWNER
identity) to edit/rename/delete it:
+---------------+--------------------------------+----------------------+
| Identity | Permissions | Apply To |
+---------------+--------------------------------+----------------------+
| Everyone | Read & Execute | This folder, |
| | | subfolders and files |
+---------------+--------------------------------+----------------------+
| Everyone | - Create files / write data | This folder and |
| | - Create folders / append data | subfolders |
+---------------+--------------------------------+----------------------+
| CREATOR OWNER | Full control | Files only |
+---------------+--------------------------------+----------------------+
| CREATOR OWNER | Delete | Subfolders |
| | | only |
+---------------+--------------------------------+----------------------+
What we're doing here is granting Everyone enough permissions to Read everything in the folder and create files & folders, but that's it. Then the CREATOR OWNER permissions take over. When an object is created, Windows applies any permissions granted to the CREATOR OWNER identity to the object's creator.
So Full Control on Files only allows the creator of a file to do anything with it he wishes. The Delete on "Subfolders only" is a bit more obscure; this is necessary to allow the creator of a folder to 1) Rename, and 2) Delete it. However, if a folder owner attempts to delete a folder that contains files or folders he does not own, then the delete operation will fail.
*These permissions allow modifying folders owned by a user, which you did not specifically request. However, if you don't allow this, then users can create a folder but not rename it. This is problematic, for example, if a user creates a folder via the Windows context menu. In this case Windows first creates a folder named New Folder then prompts the user to rename it, but once it's first created the user would in fact not be able to rename it.
“how do we prevent users from modifying the file of another owner?” You have to specifically remove the write permission from the file individually. So move read only files to their own directory – Ramhound – 2018-03-09T19:20:41.970