XP file server - full rights but not to move folders?

[Appleby]

Ok this is a strange one. I've got a customer who has a file server which is an XP Pro machine that is networked to about 10 computers in his office. All of his employees connect to the server and open large GIS and mapping files on their machines and edit them. They do not move the files to their computers while they work on them, they reside on the server.

They have about 300GB of data on the file server and it is all VERY well organized in a hierarchy of folders by client, job type, job description, location, date etc. The problem they are having is some of the employees are accidentally moving folders into other folders. This confuses people and also messes up any mapping they have set on the employees computers. Apparently this is becoming a common enough problem that they called me about it today.

So here is what they want....

1) Employees have FULL access to the file server from the network, they can move, edit, replace and delete files. They can create and rename folders but they can't MOVE them. (Obviously not an easy or likely solution)

OR

2) Anytime a folder is MOVED, a prompt pops up and asks if they meant to move the folder. Basically a warning of some type that says, "Hey did you really mean to move this folder?"

Anything like this easily possible or another solution you can think of?

Thanks!

 

[computerdoc]

If you remove delete rights from the folders, they will not be able to delete or move them.

You could have someone write a simple program to periodically check for any new folders or folders with delete rights and remove the delete rights.

 

[Appleby]

Hmm, that might work...so can I mass remove the delete permissions for all the folders in a certain directory? What about files....will they be able to delete or move actual files? I think they need that ability...just not folders?

Also, the employees are the ones creating the new folders and files for every job, so they sure don't want any new folders being deleted automatically.

Thanks for the ideas, I need to research this further.

 

[computerdoc]

The attrib dos command can work on all the files within a folder. However, it doesn't have an option to distinguish between folders and files.

A program could cycle through any location that you specify and check for folders only and change their attributes.

You may need to define a group of users since at least the system administrator should have the right to delete or move files.

 

[Appleby]

Hmm, interesting. I'd have to have someone write the program though because that is waay about my head.

Thanks for the help.

 

[computerdoc]

I could probably write it but I'm rusty so it would take me a while.

You can get someone at rent a coder or elance to do it.

 

[computerdoc]

This might be a non programming solution.

rcombis at Experts Exchange suggested the following: (with some of my own editing)

I would create 2 security groups. (On the XP machine control panel->Admin tools->Computer Mangement->Local Users and Groups. Right Click to create new group.

For this example call them "AllowMoveDelete", "NoMoveDelete"

Set up a couple of test users and add them to respective groups. (this is for testing)

I would suggest creating a seperate file share on the XP server. (for testing)
Top Level Folder = "Files"
Second Level = "Accounting" , "HR",

Put some dummy files in those folders.

Go into the Security Tab of the Files folder. Add the "NoMoveDeleteGroup". Go into advanced. Highlight that group and hit edit. Choose Deny for "Delete Subfolders and File". Choose Deny for "Delete". Hit Ok and apply.

Now try and connect to that file share as a member of the NoMoveDeleteGroup. See what you can and cannot do. Because I do not know what you specifcally want to do you may want to adjust the permissions a bit to suit your needs.

When you test as a member of the NoMoveDeleteGroup, you should not be able to Delete the "Files" folder or the "Accounting", HR folders. Also you shouldn't be able to move them. Again you may have to adjust these permissions to suit your needs. The best way to learn about this is to set up a test scenario and familiarize your self with how the permissions work.

Also say you have lower level folders that you want users to be able to do what ever they want in. You can uncheck the box to "Inherit from parent...." This is in the advanced section of security permissions. When it prompts choose copy permissions and then go in and remove/add any permissions you want which will just be for that folder and below.