Create But Not Delete Permissions

[Gongalong]

Hi folks,

 

(2008 R2 file server.)

 

I'm trying to setup a directory where students can save/upload homework. It means they need write permissions to save there, but I don't want them to be able to open other files.

 

I've obviously used advanced permissions with the following set to allow:

 

List folder / read data

Create files / write data

Write attributes

Write extended attributes

 

The following are sent to deny:

 

Traverse folder / execute file

Delete subfolders and files

Delete

 

A student account is able to copy files there, but they cannot save directly into the folder. They need to be able to do the latter, because we're using a remote access tool that uploads directly into the folder.

 

Anyone know what permissions I'm missing to allow this, or whether it's even possible?

 

TIA

[ADMaster]

Hi Gongalong

I think you will need to allow them to list / traverse the entire path of the share.

Here is a previous post I made with a permission screenshot.

http://www.edugeek.net/forums/windows-server-2008-r2/101587-student-folder-redirection-issues.html#post874322

Some applications such as word needed to see the whole path. What application are you using?

 

Also note that because you deny delete doesn’t mean they cannot erase the contents. I suggest you setup up a test account and try a few different things.

IIRC from my lab experiments if you have read and write but not delete, you can simply open the file erase the text and save. Even if you deny read if they know the name they can copy in a blank file with the same name.

Your remote access tool make take care of that though.

 

Cheers

[Gongalong]

Thanks, I'll try removing the deny on that. I have a feeling that execute file isn't the same as opening it anyway, but I could be wrong. I've had a look at MS's document on permissions, but I don't find it very clear Permissions for files and folders: User Rights; Security Policy; Security Services

[Gongalong]

I thought it might be to do with Creator Owner permissions. I tried removing the ability for Creator owner to "Delete" and "Delete Subfolders and Files" and that stopped the user from being able to save there. I will persist...