I have a batch file that copies folders from one server to another. Everything worked fine until one of the users decided to change the permissions on one of their folders to explicitly deny permission to administrators. The batch file halts in its tracks when it runs into "Access Denied". I corrected this but am trying to prevent this from happening in the future. I have the user folders designated in a shared folder called "Users". That folder currently has everything but "Full Permission" assigned for the individual user. That setting will prevent the user from changing permissions in the security tab. However, if they create a new folder, they can change the permissions on it. I have been playing around with creator/owner and explicitly denying "Change Permission" in the advanced settings. Nothing seems to work for new folders and files created by the individual user. Reference: In the first security tab it has: Full Control Modify Read & Execute Read Write In the Advanced settings it has: Traverse Folder / Execute File List Folder / Read Data Read Attributes Read Extended Attributes Create Files / Write Data Create Folders / Append Data Write Attributes Write Extended Attributes Delete Subfolders and Files Delete Read Permissions Change Permissions Take Ownership I want to allow the user to create and delete their own stuff, but I can't find the right combination to have it where they can't change the permissions on it. Is it possible? Please advise.

I've never tried it, but what about setting "Change Permission" to Deny for all the users. And then set that at "This folder and all subfolders". This should make it so they can't change any permissions, but only get what propogates down to the created file or folder....

Thanks for the suggestion.

It didn't work.