Security permissions

[redart]

Hi,
Trying to share a folder with a second user on my Win11 computer, giving them read only access. The folder is located in "Public Documents". Playing around with the Permissions I can set Read Allow, Write Deny, but this still allows the user to delete stuff. If I set Modify Deny to prevent deletion I cannot set Read Allow. What am I missing here?. Thanks.

 

[ChatGPT]

Hi there,

When it comes to setting permissions for sharing a folder, it can sometimes be a bit tricky to achieve the exact level of access you want. In this case, you're looking to give the second user read-only access to the folder located in "Public Documents" on your Windows 11 computer.

To ensure that the second user can only read the contents of the folder without the ability to modify or delete anything, follow these steps:

1. Right-click on the folder you want to share and select "Properties".
2. Go to the "Security" tab and click on the "Edit" button.
3. In the "Permissions for [folder name]" window, click on the "Add" button.
4. In the "Enter the object names to select" field, type the username of the second user and click "Check Names" to confirm the correct user is selected. Click "OK" to close the window.
5. Now, select the newly added user from the list and ensure that they have the following permissions:
- Full Control - Deny (uncheck all allow options)
- Modify - Allow (check only the read option)
- Write - Deny (uncheck all allow options)
- Read & Execute - Allow (check only the read option)
- List folder contents - Allow
- Read - Allow
- Write (Attributes) - Deny
- Read permissions - Allow
- Take ownership - Deny
- Change permissions - Deny
- Delete subfolders and files - Deny
- Delete - Deny

6. Once you have set the permissions accordingly, click "OK" to apply them.

By following these steps, the second user should only be able to read the contents of the folder and won't be able to modify or delete anything within it.

I hope this helps! Let me know if you have any further questions.

 

[Neemobeer]

Which scenario is this?

• Two users on the same machine?
• Two users on same network, but different machines?
• Two users on different networks, and different machines?

Also, are both users local admins?

 

[redart]

Which scenario is this?

• Two users on the same machine?
• Two users on same network, but different machines?
• Two users on different networks, and different machines?

Also, are both users local admins?

Thanks for the reply - first scenario - 2 users same machine, I am admin, other user not. I take it the ChatGPT answer is auto-generated, however my problem is there are no check boxes for the last 4 entries it suggests. i.e. there are no options for- Take ownership - Deny, - Change permissions - Deny, - Delete subfolders and files - Deny, or - Delete - Deny

 

[Neemobeer]

I would not use the 'Public' user directory for sharing as all users inherit permissions to delete items.
Instead I would do the following

• Create a directory such as C:\Sharing
• Right click that folder > properties > Security
• Click Advanced
• Click the 'Disable inheritance' button and choice to convert inherited permissions
• Select each permission principal except the Administrators group and remove them (optionally you could add your user with full permissions and remove the administrators group)
• Click Add and select their principal (user)
• You can leave the default 'read & execute', list content and read

Now when you drop files in this 'sharing' directory they should inherit only the manually set permissions

 

[redart]

Thank you Neemobeer !. That worked perfectly. The "Disable Inheritance" button was the key, which I would never have hit without you.