How do NTFS Permissions Work with Deletion?

Question

I have a folderA. I'd like a user (let's call him darth) to be able to do anything (create,read,write,delete) folders/files inside folderA , BUT darth should NOT be able to delete folderA itself. To achieve this I applied the following permissions.

C:\>icacls foldera
    foldera DHI-VM1\darth:(DENY)(D)
        DHI-VM1\darth:(RX,W,WDAC,WO,DC)
        NT AUTHORITY\SYSTEM:(OI)(CI)(F)
        BUILTIN\Administrators:(OI)(CI)(F)
        BUILTIN\Users:(OI)(CI)(RX)
        BUILTIN\Users:(CI)(S,WD,AD)
        CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

I know Deny takes precedence over Allow , but in this case the Deny & Allow are for different objects (deny delete on parent folder , allow on child folder). I'm still unable to delete anything inside folderA despite the perission DC (in 2nd line after WO). Why so ?

OS - Windows Server 2008 R2

Answer 1

It can be achieved in different way by manipulating advanced permissions and permissions inheritance.

For example how I do it for user mmv and folder test

D:\empty\test>icacls .
VS2K8TS\mmv:(OI)(CI)(IO)(F)
VS2K8TS\mmv:(RX,W,DC)
BUILTIN\Administrators:(I)(OI)(CI)(F)
NT AUTHORITY\system:(I)(OI)(CI)(F)
CREATOR-OWNER:(I)(OI)(CI)(IO)(F)

I only add permissions for mmv. So mmv almost like admin in this folder but unable to delete folder itself.

Point attention, user (mmv) hawe two advanced acl records, for folder itself and for sub-folders and files.