Member Avatar for Ritesh_4

Hello
Anyone can pls help me, whereby I need to prevent the users from being able to delete a specific folder in Windows 7, but still have read/write/execute permissions on that folder?
Also I would like to restrict the user's options in terms of software he/she wants to install, with a pre-defined list of the allowed software?

Cheers.

  • 2 Contributors
  • 1 Reply
  • 191 Views
  • 1 Hour Discussion Span
  • Latest Post Latest Post by JorgeM

Dani AI

Generated

Following up on and : the reliable way to stop users deleting a specific folder while still letting them read/write its contents is to use fine‑grained NTFS ACLs rather than broad Modify/FullControl. Deleting is controlled by two different special rights — the object’s Delete and the parent’s Delete subfolders and files — so you must remove the ability to delete on the folder itself and ensure the parent folder doesn’t grant delete‑child rights. See a practical explanation of the NTFS delete semantics. (itprotoday.com)

Practical approach (conceptual): make a security group for the users, then on the target folder disable or copy inheritance and add a custom ACE that allows create/write (create files/write data, create folders/append data, write attributes, read/list) but does NOT grant Delete or Delete subfolders and files. Make sure the parent folder’s ACEs don’t silently give delete‑child permission to that same group. Watch Creator Owner and owner rights (owners and administrators can change ACLs or take ownership), so avoid giving users local admin. For background on ACL/owner behavior, see Microsoft’s ACL docs. (superuser.com)

On the software‑installation side: for Windows 7 use AppLocker (Enterprise/Ultimate) where possible — it supports publisher/hash/path rules and an audit mode so you can test before enforcing — and use Software Restriction Policies (SRP) or managed whitelisting where AppLocker isn’t available. Apply rules via Group Policy, keep users out of the local Administrators group, and deploy in audit mode first to collect compatibility data. See Microsoft’s AppLocker and SRP guidance. (learn.microsoft.com)

Quick checklist before rollout: test changes in a lab account, back up existing ACLs (export or note settings), avoid broad Deny ACEs (they cause side effects), verify parent folder ACLs, and monitor object access events after applying changes. If you need scripting help (bulk changes, replication), manage via Group Policy or icacls from a controlled admin account and test thoroughly. (learn.microsoft.com)

References (quick links)

Member Avatar for JorgeM

You need to create a different set of permissions. Right click the folder, properties, security tab. Use the advanced button to access additional options. Click Add, Assign permissions to "this folder" and a different set of permissions to "subfolder and files".

Edited by JorgeM
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.