5

We have a folder for employees to scan contracts to. After scanning, they're supposed to rename them according to our conventions so they can be processed further. In response to a recent incident, these folders have had their security locked down (they're granted write, but not modify, permission) and now they are unable to rename the files.

Is there a technical way to accomplish what I'm trying to do? From what I've read, I don't think this is possible.

If not, can you suggest any workarounds? One possibility is to set the name of the file as it's being scanned in. Another is to have a trusted person in management be given sufficient permissions to rename.

Bigbio2002
  • 2,823
  • 12
  • 35
  • 54
  • Are you sure that one needs delete permissions to rename an object? That sounds strange because why would rename involve a delete? Microsoft's security model is quite a pain, whether it comes to NTFS, or AD or Sharepoint. Complexity seems to be the enemy of security. If delete permissions are required to rename a file, then it seems better to have one dedicated IT person spend a few days to complete the task, than to give all users delete permissions on the files. – Gustave Feb 15 '13 at 01:09
  • Why don't you write a script that watches for new files (the Windows API provides the means) and then hardlink them outside. Assuming someone goes and removes something from inside the realm they are supposed to be able to write to, they still can't delete the hardlinked "copy" outside ;) – 0xC0000022L Feb 15 '13 at 02:36

4 Answers4

2

Apparently rename requires the delete permission. Alternatively, could you have the files be renamed before being placed in the required folder?
Another idea - perhaps a batch job could run that would rename files appropriately that could be run as a schedule task on the server with appropriate permissions.

Paul Ackerman
  • 2,729
  • 1
  • 16
  • 23
  • How does denying delete, and simply not allowing it, differ? – Bigbio2002 Jul 17 '12 at 16:49
  • 2
    A single Deny overrides all Allows. Use 'Deny' sparingly for this reason. Administrative override still trumps Deny however. – Chris S Jul 17 '12 at 16:50
  • it would ensure that the specific user/group is not allowed to delete the file. Just in case it would be inheriting delete permissions from a higher folder. – Paul Ackerman Jul 17 '12 at 16:50
  • Currently, I have all attributes selected, except Full Control, Delete Subfolders/Files, Delete, Change Permissions, and Take Ownership. This allows creation (and modification) of files, but does not allow deleting (and hence renaming). – Bigbio2002 Jul 17 '12 at 16:53
  • Edited - after testing apparently delete is required for rename – Paul Ackerman Jul 17 '12 at 17:00
  • 1
    Note: an Explicit Allow overrides an Inherited Deny. Here's the order of NTFS permissions precedence: Inherited Allow - Inherited Deny - Explicit Allow - Explicit Deny – joeqwerty Jul 17 '12 at 19:05
1

Not only using NTFS file permissions.

You could create a program which runs as a service that is started when the computer starts. Said service runs under an account which is allowed to delete and create files (and thus rename files).

Then you create a small program which performs rename on files by calling the service you wrote. That program could present itself in the explorer context menu when right clicking on a file as "Privileged rename".

Deleted
  • 1,832
  • 8
  • 23
  • 31
0

Let me write my comment up as an answer. You could write a resident PowerShell script that uses (Start-FileSystemWatcher from PowerShellPack) to watch for new files in that particular location and then hardlink those into a location not accessible by the employees. Your biggest concern seems to be that none of the data ever gets removed again, so this would accomplish it, while still providing the Delete ACE needed for renaming. In your "backup" location with the hardlinks you could then keep an index based on the cryptographic has (SHA1 comes to mind) and thus avoid duplicates. Of course the complexity of this can be bumped up further to suit your needs.

Of course such PowerShell script could take over the renaming task itself. Depends on how easy the rules are to automate.

0xC0000022L
  • 1,516
  • 2
  • 22
  • 42
-2

Rename is actually a move command in terms of FS operations, so the answer is NO.

user49146
  • 1