Remove delete permission for active directory group in Microsoft 2008 Server R2

Question

I've created a group in Active Directory and I would like to prevent all users in this group from being able to delete any files on the server. How would I go about doing this?

Solution

Although this is not a particularly good approach, to do it this way, you'd be concerned with the Delete and Delete subfolders and files permissions. (Advanced options in the Security tab, if using the GUI.)

Probably the easiest way would be to Deny those permissions on your volume roots, to the group in question. Make sure you also prevent the group in question from having Change permissions or Take ownership rights, or they'll be able to grant themselves those permissions back. (Also make sure to apply the permissions all the way down - Apply to: This folder, subfolder and files - and catch the files and directories where the permissions are unable to be applied.)

Of course, as mentioned in the comments, Deny ACEs can cause some issues, so this is probably not the best approach to whatever it is you're trying to accomplish. People you can't trust to not delete stuff shouldn't be on the server in the first place. I'd probably just give them read only permissions to whatever directory tree they needed, rather than going through the extra effort of allowing full access to the server and then customizing advanced permissions options.

Comments

[Zoredache]

There is not simple 'prevent delete' setting. You must review all your acls on any shares, filesystems, and other objects. Do keep in mind that preventing deletion often means making things read only. There are several applications that simply will not be able to 'modify' a document unless they have the ability to delete it.

[HopelessN00b]

@Zoredache actually, there kinda is a "prevent delete" setting, at least with NTFS.

[Zoredache]

@HopelessN00b, Yes, I know you can have a Deny ACE on the filesystem that prevents deletion, but it isn't system-wide, you must look at all the filesystems, and pay attention to any locations where inheritance is blocked. Deny ACEs interact badly with other ACLs because of the inherent problems with deny ACEs.

[Flea]

Great, thanks! I appreciate it! Sounds like the right approach!