You can accomplish your goal with what I call Top Level Folder Permissions.
Summary
- On the drive's root, grant Read permissions to your users which flow down to all subfolders and files throughout the drive.
- On each "Top Level" folder in the root drive, apply special permissions that grant users Modify permissions to the folders' contents (all files and subfolders) but not to the Top Level folders themselves.
Steps to Implement
- On the Root drive, grant
Everyone
(or another group of your choice) standard Read permissions
- Optionally, on the Root drive, consider ensuring
SYSTEM
and Administrators
are granted Full Control, then remove all other permissions (e.g. those granted to CREATOR OWNER
or Users
)
- On each Top-Level folder:
- Grant the
Everyone
group Modify permissions, then edit that permission assignment in the Advanced Security Settings to apply to Subfolders and files only
- Still in Advanced Security Settings make another entry granting the
Everyone
group the following specific permissions and apply these to This folder only:
- Create files / write data
- Create folders / append data
- Repeat step #3 for each Top Level folder
How it Works
The effect of #1 is to grant your security group the ability to Read everything on the drive.
The effect of #3 is to grant your security group the ability to Modify all child objects of your Top Level folders without granting them permission to modify the Top Level folders themselves. This isn't sufficient to permit them to Create anything in the Top Level folders, hence the extra explicit 'create' permissions.
Apply to Many Top Level Folders
The permissions of step #3 above must be applied to each "Top Level" folder. This can be time consuming if you have many folders. These permissions can be applied to all subfolders in the drive's root using the FOR and ICACLS run in an Elevated Command Prompt:
For /D %f In (C:\*.*) Do ICACLS "%f" /grant "Everyone":(OI)(CI)(IO)(M)
For /D %f In (C:\*.*) Do ICACLS "%f" /grant "Everyone":(WD,AD)
As shown, these two commands will modify all subfolders in C:\
to grant the permissions outlined in step #3 to the Everyone
group. Modify these two elements to suit your needs. Test first before running on a production system!
Awesome, thanks so much @Twisty, only annoyance is there are thousands of "Top Level Folders" that need to be restricted to read only with subfolder read/write permissions. I would imagine that this would be done quicker with the cmd prompt. – NeilR – 2014-11-23T18:27:08.943
Script provided in updated answer. No more annoyance! Please upvote if this gets you to where you want to be! – I say Reinstate Monica – 2014-12-01T21:59:05.927