File security on an XP pro network

Posted on 2003-12-10
Medium Priority
Last Modified: 2010-03-19
I have a small network of 4 computers all running XP pro and using simple “workgroups” MS networking. I want all users to file/save all their work in one specific partition on the biggest of the 4 machines ( aka the Server). So far so good……However if anyone makes a change to a file I would like this to be as a new version only, and leave the original intact. Similarly I do not want anyone ( except me!)  to be able to delete files which are on the Server. The files will be a broad spectrum of everything from MS word docs to Autocad drawings……Any ideas?
Question by:SeanPP
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Expert Comment

ID: 9911618
This partition should be formated with NTFS file system
So you can make accounts for all users and you on "aka the Server" with apropriate NTFS permisions for the "specific" partition

LVL 18

Expert Comment

ID: 9912605
Windows security does not have the ability to mask file permissions in that way in any practical sense.

You are looking for a version control system, or document management system.
Sharepoint is Microsoft's offering.
If you're using Autocad, you should visit http://www.oasys-software.com/


Expert Comment

ID: 9912658
there is many ways to do that, creatre folder for each user and one for everyone, in the one for everyone put all the files, and give them just read access, then give them full accces to their folders, and tell them to take a job from the all user folder and safe it in their folders, you need NTSF partition on the server for that. plus you need account and passwords of all the users created on the server same like they have on the local machines, this way they will not be prompted for the password each time they conenct to shares

Take Care
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.


Author Comment

ID: 9934384
nice idea Sebo..but that does rely on the users ...er, shall we say listening to what they are told. I thought about putting everything in one folder on the server and making everything read only. That way when they make changes they would have to "save as". I am making all file names made up of title and date...yes that is cumbersome but it keeps things simple......

Anyone have a better idea?
BTW all partitions are NTFS

Ps great answer Sebo and Chicagoan...
LVL 18

Expert Comment

ID: 9934793
That's about the most practical work-around, run a cron job to flag them RO or take ownership with cacls.
If you can get your checkbook and head around a proper document management system you won't be sorry.


Author Comment

ID: 9935049
Sorry Chicagoan......what is "cron job"  and also "calcs"? Also, can you reccomend a documnet managment system?


LVL 18

Expert Comment

ID: 9935091
Document management systems:
If you're using Autocad, you should visit http://www.oasys-software.com/
Sharepoint is Microsoft's offering. http://www.microsoft.com/sharepoint/

Windows includes a task scheduler
cron is a scheduler ported from unix, try the above to see if it works for you first.


Display or modify Access Control Lists (ACLs) for files and folders.

Access Control Lists apply only to files stored on an NTFS formatted drive, each ACL determines which users (or groups of users) can read or edit the file. When a new file is created it normally inherits ACL's from the folder where it was created.

      CACLS pathname [options]
      CACLS pathname
key   options can be any combination of:   /T Search the pathname including all subfolders.
   /E Edit ACL (leave existing rights unchanged)   /C Continue on access denied errors.
   /G user:permission      Grant access rights, permision can be:          R Read
         C Change (write)
         F Full control
   /R user      Revoke specified user's access rights (only valid with /E).
   /P user:permission         Replace access rights, permission can be:          N None
         R Read
         C Change (write)
         F Full control
   /D user Deny specified user access.    In all the options above "user" can be an NT Username
   or an NT Workgroup (either local or global)

   If a username or groupname includes spaces then
   it must be surrounded with quotes e.g. "Authenticated Users"

   If no options are specified CACLS will display the ACLs for the file(s)
Other features to try

Wildcards can be used to specify multiple files.
You can specify more than one user:permission in a single command.
The /D option will deny access to a user even if they belong to a group that does have access.


The CACLS command does not provide a /Y switch to automatically answer 'Y' to the Y/N prompt. However, you can pipe the 'Y' character into the CACLS command using ECHO, use the following syntax:

ECHO Y| CACLS /g <username>:<permission>

To edit a file you must have the "Change" ACL (or be the file's owner)

To use the CACLS command and change an ACL requires "FULL Control"

File "Ownership" will always override all ACL's - you always have Full Control over files that you create.

If CACLS is used without the /E switch all existing rights on [pathname] will be replaced, any attempt to use the /E switch to change a [user:permission] that already exists will raise an error. To be sure the CALCS command will work without errors use /E /R to remove ACL rights for the user concerned, then use /E to add the desired rights.

The /T option will only traverse subfolders below the current directory.


Adding new file permissions to a group of users
CACLS myfile.txt /E /G "Power Users":F

If we now grant Read permissions to the same group they will still have FULL control
CACLS myfile.txt /E /G "Power Users":R

This command will replace the first ACL granted and allow only Read access:
CACLS myfile.txt /E /P "Power Users":R


Author Comment

ID: 9935799
Wow.......Fantastic answer Chicargo......It is going to take me a little while to understand this, but am giving it a go.....Thanks again, i'll let you know how i get on. Sean

Author Comment

ID: 9936924
On allmost the same subject......Is there a way of locking folders?....I mean some kind of password protection that one unlocks at the start of the day and then locks again when one has finished work. The files then being protected in case of ever being stolen?
LVL 18

Accepted Solution

chicagoan earned 2000 total points
ID: 9937355
Files ARE locked, more or less, until you log in.
XP automates the login process for you but it doesn't have to be that way.


Featured Post

The Ideal Solution for Multi-Display Applications

Check out ATEN’s VS1912 12-Port DP Video Wall Media Player at InfoComm 2017. Kerri describes how easy it is to design creative video walls in asymmetric layouts and schedule detailed playlists ahead of time with its advanced scheduling feature.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
This month, Experts Exchange’s free Course of the Month is focused on CompTIA IT Fundamentals.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question