I'm so flabbergasted by this problem, there is no other title that fits.
Goal: I have a shared network folder with a "Scans" sub folder that I do not want a user to be able to change or delete. However, I want them to be able to change and delete the subfolders and files of the "Scans" folder. The"Scans" folder is a special folder that our network scanner scans to. So, to recap, users (specifically the "Staff" user group) should be able to have full control to all subfolders and files of the top level network folder, but not
able to change the "Scans" folder.
Problem: NO matter what I set for permissions, unless there are NO permissions at all, the user can delete the "Scans" folder.
The top level network folder is called "Shared" and is shared from a Windows Server 2012 R2 system. All share permissions are set to Everyone:Full control. NTFS permissions on the top level "Shared" folder are as follows:
Administrators:F (This folder, subfolders, and files)
CREATOR OWNER:F (Subfolders and files)
SYSTEM:F (This folder, subfolders, and files)
CPSAdmin:F (A domain admin user) (This folder, subfolders, and files)
Domain Admins:F (This folder, subfolders, and files)
Staff:F (the user group in question) (This folder, subfolders, and files)
I create a subfolder called "Scans." The proper NTFS permissions to accomplish this should be as follows:
Disable Inheritance
Administrators:F (This folder, subfolders, and files)
CREATOR OWNER:F (Subfolders and files)
SYSTEM:F (This folder, subfolders, and files)
CPSAdmin:F (This folder, subfolders, and files)
Domain Admins:F (This folder, subfolders, and files)
Staff:R (This folder only)
Staff:F (Subfolders and files)
The user navigates to the shared network folder and attempts to delete the Scans folder - SUCCESS.
I have tried the following additional combinations of permissions for the Staff group with the following results:
Remove them completely - they no longer can delete, or access the Scans folder.
Read Only on this folder, subfolders, and files - they can no longer create any subfolders or files, but they can still delete the "Scans" folder
Explicitly DENY modification, deletion, etc. to this folder - Users can still delete the "Scans" folder.
Its embarrassing really. Such a basic, rudimentary thing that is so critical. Yet, a huge gaping security hole. It seems if the user is given any form of read permission to the folder they can delete it.
To top it all off - reviewing the Effective Permissions for this user group specifically shows that they have the intended permissions, that is,they CANNOT delete or modify the folder. Yet, a member of the Staff user group can still delete the folder from a workstation. Here is a screenshot of the effective permissions for a test user that can still delete the "Scans"
folder:
![]()
It should also be noted that the owner of these folders is "Administrators" and that the logged on user is not a member of any other groups listed above. i.e. They are not domain admins, owners, or any other group that has access to this folder. As shown above, if I remove all permissions for "Staff" they lose all permissions to the folder as expected.
I have no choice but to assume there is actually a serious NTFS bug here.
