Create file/folder permission without delete permission

Question

Is there a way I can set create file/folder permissions for a user in Windows 7 without giving delete permission for a folder?

I don't want the user to delete any files in that folder, but he should be able to make new files,rename them, and copy new files to that folder. Is this possible in Windows?

Answer 1

You cannot disallow deletes and expect rename to work, as explained below.

Windows treats a file renaming operation as a deletion of the file and creation of a new file with the new name. Therefore, you absolutely must have one or both of the following two permissions:

• Delete permission on the file itself, or
• Delete Subfolders and Files permission on the folder that contains the file.

To complete the list, for renaming you require in addition the following permissions:

• Write Data permission on the folder because of the new-file creation
• Read Attributes permission to both the folder and the actual file
• Synchronize permission to both the folder and the actual file
• List Directory permission to the folder.

These permissions allow the rename command to check for the existence of the file and verify that the file's attributes (for example, the Read Only attribute) don't prevent the rename.

Answer 2

Right click the folder → Properties → Security → Advanced → Permissions → Change Permissions → <select user> → Edit. You can specify (deny) very detailed permissions in there, including the Delete permission

BTW, don't use "CREATOR OWNER" (that was just an example). Use the actual user or group you wish to deny the permission to.

Answer 3

What you write what you want is not possible. If a user wants to rename a file this requires the right to delete it (see Server Fault or WindowsIT Pro).

If it is OK for you that users can create new files in the folder and do with them whatever they want, but not mess with other files (like in a shared temp folder), you can change the permissions for the folder. In Windows Explorer, right click/properties on the folder, Permissions, Advanced, and change permissions. The required rights are:

"this folder, subfolders, files": "Read, Write, Execute" (search folder, list folder, read attributes. read extended attributes, create files, create folders, write attributes, write extended attributes) for the users in question.

"only subfolders and files": full access for "CREATOR OWNER".

Answer 4

In the property dialog of the folder choose Advanced and then Change permissions.

There you can set differentiated rights. You can choose if the rights shall apply to folders, files, or both.

Answer 5

Are you sure it is not already as you want it by design? If the users are not administrators they can create/delete THEIR OWN files, but they can ONLY read the files created there by other users. Isn't that enough?

The default NTFS permissions do just that. Create a folder as an administator and check the security on it - notice that Users have Read & Execute, List Folder Contents, Read and Special Permissions - which as you can see in advanced means Create files / Write Data, Create Folders / Append Data.

From what you described I think this is what you wanted ;)