I have a batch file that copies folders from one server to another. Everything worked fine until one of the users decided to change the permissions on one of their folders to explicitly deny permission to administrators. The batch file halts in its tracks when it runs into "Access Denied". I corrected this but am trying to prevent this from happening in the future.

I have the user folders designated in a shared folder called "Users". That folder currently has everything but "Full Permission" assigned for the individual user. That setting will prevent the user from changing permissions in the security tab.

However, if they create a new folder, they can change the permissions on it. I have been playing around with creator/owner and explicitly denying "Change Permission" in the advanced settings. Nothing seems to work for new folders and files created by the individual user.

Reference:

In the first security tab it has:
Full Control
Modify
Read & Execute
Read
Write

In the Advanced settings it has:
Traverse Folder / Execute File
List Folder / Read Data
Read Attributes
Read Extended Attributes
Create Files / Write Data
Create Folders / Append Data
Write Attributes
Write Extended Attributes
Delete Subfolders and Files
Delete
Read Permissions
Change Permissions
Take Ownership

I want to allow the user to create and delete their own stuff, but I can't find the right combination to have it where they can't change the permissions on it.

Is it possible? Please advise.

I've never tried it, but what about setting "Change Permission" to Deny for all the users. And then set that at "This folder and all subfolders". This should make it so they can't change any permissions, but only get what propogates down to the created file or folder....

Thanks for the suggestion.

It didn't work.