How to make a folder read-only in Windows?

Question

So I want to prevent myself writing into some files into folder. I always works with back_up folders in which I compare, transfer data to target projects. The problem is that sometimes on mistake I edit the Back-Up files. Is there any way I can deny the edit/write permission for myself? I don't want files to be renamed/deleted. Setting the folder read only flag is something that does absolutely nothing - after that I can edit/delete files with no problem again (at least in Win 8.1). This is very important for me - because for now I've corrupted many back_up files that way and this give me a lot of trouble. Any ideas?

I'm running latest version of Windows 8.1 x64.

Answer 1

Original answer:

If it's NTFS, you can use the file system security feature.

1. Edit the folder's "security" tab, I'm assuming you didn't change them before: delete "authenticated users", it may warn you that you must disable inheritance first, do so in the "advance" option.

2. Make sure UAC is on.

Now when you try to edit/add/delete anything inside that folder, UAC will warn you, you can even set it to higher level that you must enter your password every time.

Edit: The above method is a fool-proof easy guide, which only apply to Windows Vista+ and require admin rights, and untempered file/folder security settings to start with.

However if you understand the principle behind, you can do this on nearly any Windows version with NTFS, on any user account.

Assume your normal working account is A, and another "safe" account is B, you can set the folder owner to B and give full privilege to it (don't forget to check "replace all child object permissions with inheritable permissions from this object"), then add account A as read-only, and now you can only write to it with account B, while still read/use it in the daily account A.

Without administrator rights, you cannot remove administrator from the access list, nor change the owner if it was administrator. But the method should work anyway, also if you create the folder, the owner should be default to you.

PS. All above are based on my experience, welcome to advice if you have better method.

Answer 2

_{It's a single folder containing the files. Each time I make a change, I do "Save As" and increment the version number. However, sometimes I accidentally hit "Save" and overwrite my file – Steven Vascellaro}

---

How to make files within a folder read only accessible

You can use ICACLS and explicitly deny the write attributes permission to all the files within a specific folder and prevent yourself (or any security group) from overwriting or modifying these files but still allow read access to open them.

Below is a batch script with environmental %userdomain%\%username% variables to define the current domain (or local machine name) and username signed onto the machine you execute the batch script as (i.e. <domain>\<username>) to deny the access to the account; this can easily be replaced with any valid domain security group name if needed as well (i.e. <domain>\<securitygroupname>).

Batch Script

Replace the value of the Folder= variable to be the full explicit folder path (or UNC path) to the location you need to make the existing files within read only accessible.

@ECHO ON

SET Folder=C:\Users\User\Desktop\Test
SET Security=%userdomain%\%username%

ICACLS "%Folder%\*" /deny "%Security%":(OI)(WA)
EXIT

If you look at the file ACL permissions, you will see the write attributes with an explicit deny now that applied to this folder and files.

Here's a folder with test documents with V1, V2, and so on which has already had be batch script run against.

If you try to save the file the save as dialogue will pop up, and if you try to overwrite the file that already exists with the same file name, you will get an access denied error message since that file is read-only accessible for this account.

You simply do a save as, give the file a different name but to the same folder which you locked down all the files to be read only accessible, and this is where you'd increment your number up by one or whatever.

Any newly saved files in this folder will now have the write attributes denied and thus these permission restrictions are applied to it effective immediately once the file with the new file name is saved to this folder.

---

Further Reading and Resources

• Environment Variables

• ICACLS

  /deny Sid:perm explicitly denies the specified user access rights.
      An explicit deny ACE is added for the stated permissions and
      the same permissions in any explicit grant are removed.
  
  WA - write attributes
  
  
      inheritance rights may precede either form and are applied
      only to directories:
  (OI) - object inherit
  

Answer 3

Romeo is correct, you can make your individual files read-only that way through the properties, but you won't be able to protect it from deletion.

A further suggestion, if you'd like to quickly change multiple files to read only.

Open up a command prompt and enter the command attrib +r [path] taking advantage of the wildcard *

Answer 4

Right click on folder, Properties, below Attributes, set ReadOnly, Apply.

This will make all files in this folder (and subfolders if you select) to be only for read. When you try to save R/O file the software will offer you to Save As different name