Setting Permissions

[MarkLappin]

Howdy All,

I have a rather complex permissions problem that I am fighting with and beating my head against the wall over something which should be fairly simple.

Essentially and of utmost priority I need to restrict the DELETE files and folders permission --- seems easy enough right? just uncheck or unset the delete bit/box. Well, no, then they're losing all ability to change files.

my server is in the middle of a few to many things right now for me to go and grab the exact settings but I will post a follow up in a little bit (after close of business and link to screen shots).

I'd also like to restrict the ability to create new folders but this also seems to remove teh modify/append data permission.

The problem I'm having with the prioroty one is that removing delete seems to set everything for teh users that they can read only. Now when I run "effective permissions" it looks fine, in my testing its fine (and I'm testing as a normal user, not a domain admin) but when everybody comes in the next day i get panic calls that nobody can save documents.

Any thoughts?
Mark L.

 

[MarkLappin]

Sorry it took a while, I've been busy:

These are the permissions not working but lok like what I want, they're applied to the Z clients only, ZClient is not a real client, I've changed the name since this is legal data and attorney client-confidentiality applies; these are the permissions that do not work:

F:\clients\Z>cacls zClient
F:\clients\Z\ZClient rsctaxbusters\No Legal Data
AccessOI)(CI)N
BUILTIN\AdministratorsOI)(CI)F
CREATOR OWNEROI)(CI)(IO)F
rsctaxbusters\Domain
UsersOI)(CI)(special access
READ_CONTROL
SYNCHRONIZE
FILE_GENERIC_READ
FILE_GENERIC_WRITE
FILE_GENERIC_EXECUTE
FILE_READ_DATA
FILE_WRITE_DATA
FILE_APPEND_DATA
FILE_READ_EA
FILE_WRITE_EA
FILE_EXECUTE
FILE_READ_ATTRIBUTES
FILE_WRITE_ATTRIBUTES
NT AUTHORITY\SYSTEMOI)(CI)F


F:\clients\Z>



Here are the ones that DO work but it gives domain users FULL control which i don't want:

F:\clients\C\CClient rsctaxbusters\No Legal Data AccessOI)(CI)N
rsctaxbusters\Domain UsersOI)(CI)(special access
SYNCHRONIZE
FILE_APPEND_DATA

BUILTIN\AdministratorsOI)(CI)F
CREATOR OWNEROI)(CI)(IO)F
rsctaxbusters\Domain UsersOI)(CI)F
NT AUTHORITY\SYSTEMOI)(CI)F


F:\clients\C>


----
Any help appreciated