Removing delete permissions from users.

[cava83]

Too long to explain why.

We have a Windows 2008 file server, with thousands of documents. Word/excel and so on.

I need to remove the ability for users to delete files/folders.

Apparently, this is not possible with Office documents, as when you modify a document, it requires delete permissions for the temp file and thus, if you remove delete permissions, you get access denied when trying to save the document.

Any thoughts on this?

G.

 

[Sym0n]

Grant them 'Append Data' over just the files and remove delete perms from everything else? (Guess btw).

 

[H182]

We had this issue, didn't get an issue with saving though just ended up with thousands of temp files that couldn't be deleted. We just told the department in question either someone would have to be responsible for clearing the temp files out weekly, or they'd have to manage people better so files weren't deleted.

Only thing I can think to try is to give creator owner permissions to delete, as technically the temp files will be created by them? Only issue there is they could potentially delete the original files if they created them in the first place. Not sure if it would work like.

 

[cava83]

It's a difficult one. I would like just to grant one individual the ability to delete files, but everyone else having that declined.

There must be a solution for this, strange, I will carry on looking. Any further info appreciated.

G.

 

[Longy]

Those pesky .tmp files! I switched on auditing for file deletion for a customer as someone keep deleting files, bloody log gets filled with .TMP file deletions.

 

[iain187]

some kind of script to go through and clear it at night?

 

[TST4R]

I might be wrong, but i think in AD you need to set permission rights, or write custom scripts to restrict UAC

 

[cava83]

We had this issue, didn't get an issue with saving though just ended up with thousands of temp files that couldn't be deleted. We just told the department in question either someone would have to be responsible for clearing the temp files out weekly, or they'd have to manage people better so files weren't deleted.

Only thing I can think to try is to give creator owner permissions to delete, as technically the temp files will be created by them? Only issue there is they could potentially delete the original files if they created them in the first place. Not sure if it would work like.

Ah ok, well temp files I could create a script, no problem with that. Can you let me know how you did the above so I can replicate the same setup?

 

[H182]

Just add creator owner to the ACL of the top folder and grant it modify permission (providing child folders inherit permissions). Don't know if it will work though never tried it myself.