File security on an XP pro network

Posted on 2003-12-10
Last Modified: 2010-03-19
I have a small network of 4 computers all running XP pro and using simple “workgroups” MS networking. I want all users to file/save all their work in one specific partition on the biggest of the 4 machines ( aka the Server). So far so good……However if anyone makes a change to a file I would like this to be as a new version only, and leave the original intact. Similarly I do not want anyone ( except me!)  to be able to delete files which are on the Server. The files will be a broad spectrum of everything from MS word docs to Autocad drawings……Any ideas?
Question by:SeanPP
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Expert Comment

ID: 9911618
This partition should be formated with NTFS file system
So you can make accounts for all users and you on "aka the Server" with apropriate NTFS permisions for the "specific" partition

LVL 18

Expert Comment

ID: 9912605
Windows security does not have the ability to mask file permissions in that way in any practical sense.

You are looking for a version control system, or document management system.
Sharepoint is Microsoft's offering.
If you're using Autocad, you should visit


Expert Comment

ID: 9912658
there is many ways to do that, creatre folder for each user and one for everyone, in the one for everyone put all the files, and give them just read access, then give them full accces to their folders, and tell them to take a job from the all user folder and safe it in their folders, you need NTSF partition on the server for that. plus you need account and passwords of all the users created on the server same like they have on the local machines, this way they will not be prompted for the password each time they conenct to shares

Take Care
WordPress Tutorial 4: Recommended Plugins

Now that you have WordPress installed, understand the interface, and know how to install new parts, let’s take a look at our recommended plugins.


Author Comment

ID: 9934384
nice idea Sebo..but that does rely on the users, shall we say listening to what they are told. I thought about putting everything in one folder on the server and making everything read only. That way when they make changes they would have to "save as". I am making all file names made up of title and date...yes that is cumbersome but it keeps things simple......

Anyone have a better idea?
BTW all partitions are NTFS

Ps great answer Sebo and Chicagoan...
LVL 18

Expert Comment

ID: 9934793
That's about the most practical work-around, run a cron job to flag them RO or take ownership with cacls.
If you can get your checkbook and head around a proper document management system you won't be sorry.


Author Comment

ID: 9935049
Sorry Chicagoan......what is "cron job"  and also "calcs"? Also, can you reccomend a documnet managment system?


LVL 18

Expert Comment

ID: 9935091
Document management systems:
If you're using Autocad, you should visit
Sharepoint is Microsoft's offering.

Windows includes a task scheduler
cron is a scheduler ported from unix, try the above to see if it works for you first.


Display or modify Access Control Lists (ACLs) for files and folders.

Access Control Lists apply only to files stored on an NTFS formatted drive, each ACL determines which users (or groups of users) can read or edit the file. When a new file is created it normally inherits ACL's from the folder where it was created.

      CACLS pathname [options]
      CACLS pathname
key   options can be any combination of:   /T Search the pathname including all subfolders.
   /E Edit ACL (leave existing rights unchanged)   /C Continue on access denied errors.
   /G user:permission      Grant access rights, permision can be:          R Read
         C Change (write)
         F Full control
   /R user      Revoke specified user's access rights (only valid with /E).
   /P user:permission         Replace access rights, permission can be:          N None
         R Read
         C Change (write)
         F Full control
   /D user Deny specified user access.    In all the options above "user" can be an NT Username
   or an NT Workgroup (either local or global)

   If a username or groupname includes spaces then
   it must be surrounded with quotes e.g. "Authenticated Users"

   If no options are specified CACLS will display the ACLs for the file(s)
Other features to try

Wildcards can be used to specify multiple files.
You can specify more than one user:permission in a single command.
The /D option will deny access to a user even if they belong to a group that does have access.


The CACLS command does not provide a /Y switch to automatically answer 'Y' to the Y/N prompt. However, you can pipe the 'Y' character into the CACLS command using ECHO, use the following syntax:

ECHO Y| CACLS /g <username>:<permission>

To edit a file you must have the "Change" ACL (or be the file's owner)

To use the CACLS command and change an ACL requires "FULL Control"

File "Ownership" will always override all ACL's - you always have Full Control over files that you create.

If CACLS is used without the /E switch all existing rights on [pathname] will be replaced, any attempt to use the /E switch to change a [user:permission] that already exists will raise an error. To be sure the CALCS command will work without errors use /E /R to remove ACL rights for the user concerned, then use /E to add the desired rights.

The /T option will only traverse subfolders below the current directory.


Adding new file permissions to a group of users
CACLS myfile.txt /E /G "Power Users":F

If we now grant Read permissions to the same group they will still have FULL control
CACLS myfile.txt /E /G "Power Users":R

This command will replace the first ACL granted and allow only Read access:
CACLS myfile.txt /E /P "Power Users":R


Author Comment

ID: 9935799
Wow.......Fantastic answer Chicargo......It is going to take me a little while to understand this, but am giving it a go.....Thanks again, i'll let you know how i get on. Sean

Author Comment

ID: 9936924
On allmost the same subject......Is there a way of locking folders?....I mean some kind of password protection that one unlocks at the start of the day and then locks again when one has finished work. The files then being protected in case of ever being stolen?
LVL 18

Accepted Solution

chicagoan earned 500 total points
ID: 9937355
Files ARE locked, more or less, until you log in.
XP automates the login process for you but it doesn't have to be that way.

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Suggested Courses
Course of the Month10 days, 13 hours left to enroll

628 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question