How to grant read-only access of a drive to a user?

[Bradex]

I have a admin account and a normal user account say XXX.

I have a drive (say Z), to which I want to restrict access to the user XXX. The user should be able to read the documents and view the videos in the drive. However, he should not be able to delete/modify the files in the drive or write new files to the drive.

I have gone through: Permissions - Allow or Deny Access to Users and Groups in Windows 8. I'm not comfortable with command prompts or registry keys, so I tried option three (Change Access Permissions in Advanced Security Properties).

By default, the user had permission for "Read, Read & execute, List folder contents" only. However, even with these I found that the user could delete and modify the files/folders in drive Z. So, I denied the following: "Create file/folders, write attributes/extended attributes, delete subfolders/files". This seems to serve my purpose.

Now I wish to know two things:
1) Am I doing the right thing or messing up something?
2) There was a radio button "Only apply these permissions to objects and/or containers within this container". This I had left unchecked. Should I check this? The window (see attachment) clearly states that these permissions apply to "this folder, subfolder and files". Is this just a redundant option?

Thanks!

 

[Bradex]

I'm still having problems.

The user is able to delete some files within some folders. I don't know why. This seems to occur randomly.

Is this because the user is part of the group 'PC/users' created by default by windows? I don't think so because by default this group has only read-only permissions and deny permissions should override them.

PS: I learnt that, if the radio button "Only apply these permissions to objects and/or containers within this container" is checked then permissions will be applied only to current folders and subfolders and not to subsequently created folders and files. Hence I had left it unchecked.

 

[topgundcp]

You could try:

1. right click on Z: drive ->Properties->Security
2. If there is a user: Everyone on the list, click edit and change permission to read or to read & execute only and List folder contents

 

[OldGuyGeek]

I'm still having problems.

PS: I learnt that, if the radio button "Only apply these permissions to objects and/or containers within this container" is checked then permissions will be applied only to current folders and subfolders and not to subsequently created folders and files. Hence I had left it unchecked.

I don't believe that is correct about subsequently created folders and files.

Folders and files inherit permissions from their parent unless overwritten by settings in a lower folder. It would make no sense to restrict settings and then ignore them during later operations. I have never seen that behavior.

The intent of the checkbox is to propagate the settings to all files and folder beneath the one you are in. You should check it and let it change all the settings. Depending on the number of files and folders, it may take awhile, but thank god it's a lot faster than it used to be.

Here's a couple of Microsoft TechNet pages on permissions:

Permissions for files and folders: User Rights; Security Policy; Security Services

Changing inherited permissions: User Rights; Security Policy; Security Services

 

[Bradex]

topgundcp:

Those permissions you have mentioned are present by default for every user. Then I singled out this user XXX, and added the 'deny' permissions which I have mentioned above. Still facing problems. Some files within the drive Z could still be deleted!

 

[Bradex]

OldGuyGeek: Thanks for the info!

I got my info from here: Selecting where to apply permissions

Correct me if my interpretation is wrong.

 

[Bradex]

Such a simple task has been made so painful by MS!

I wanted all my subfolders to inherit the same permissions. Hence, as described here 'To set, view, change, or remove special permissions for files and folders' I checked 'replace all child object permission entries with inheritable permission entries from this object'. Then windows started applying the permissions. While doing so it gave me an error message saying that 'Failed to enumerate objects in that container'. This was followed by 'Recycle bin is corrupt' message.

Now, I found that user XXX could still delete the files. But now, in addition the deleted files became unrecoverable!!! There was no option to undo delete!!!

Then I tried ticking: 'Only apply these permissions to objects and/or containers within this container' as per instructions from the same article.

This also produce the same results.

Pretty mad and frustrated. I'm going to delete the user altogether.

Anybody, is there no way to do this simple thing: "Having a user rights to view the files in a drive but deny rights to delete/modify/write files in the drive".

Will a guest user account able to do this?
OR
Is there any simple way to do this for a standard user account?

Please help!

 

[Bradex]

Frustrated with everything, I deleted the standard user XXX and am now using a guest account. The problem still persists though. Guest users are able to delete some files but not others.

Done with windows and its UAC! Phew!

 

[OldGuyGeek]

What directory are you trying to protect? If it is a user's default directory, like Documents, Pictures, Videos (you mentioned videos) under a user directory, you may be having additional problems because of that. Especially if you are trying to restrict the Public directories.

Can you give the exact pathname, like D:\Backup\Videos or whatever.

 

[Bradex]

It's not a user's directory. It's one of the partitions in my PC (not C drive). It's contents includes videos, pictures, documents, etc. each organized into a folder. E.g. D:\Pictures folder.