File security on an XP pro network

Posted on 2003-12-10
Last Modified: 2010-03-19
I have a small network of 4 computers all running XP pro and using simple “workgroups” MS networking. I want all users to file/save all their work in one specific partition on the biggest of the 4 machines ( aka the Server). So far so good……However if anyone makes a change to a file I would like this to be as a new version only, and leave the original intact. Similarly I do not want anyone ( except me!)  to be able to delete files which are on the Server. The files will be a broad spectrum of everything from MS word docs to Autocad drawings……Any ideas?
Question by:SeanPP

Expert Comment

ID: 9911618
This partition should be formated with NTFS file system
So you can make accounts for all users and you on "aka the Server" with apropriate NTFS permisions for the "specific" partition

LVL 18

Expert Comment

ID: 9912605
Windows security does not have the ability to mask file permissions in that way in any practical sense.

You are looking for a version control system, or document management system.
Sharepoint is Microsoft's offering.
If you're using Autocad, you should visit


Expert Comment

ID: 9912658
there is many ways to do that, creatre folder for each user and one for everyone, in the one for everyone put all the files, and give them just read access, then give them full accces to their folders, and tell them to take a job from the all user folder and safe it in their folders, you need NTSF partition on the server for that. plus you need account and passwords of all the users created on the server same like they have on the local machines, this way they will not be prompted for the password each time they conenct to shares

Take Care
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.


Author Comment

ID: 9934384
nice idea Sebo..but that does rely on the users, shall we say listening to what they are told. I thought about putting everything in one folder on the server and making everything read only. That way when they make changes they would have to "save as". I am making all file names made up of title and date...yes that is cumbersome but it keeps things simple......

Anyone have a better idea?
BTW all partitions are NTFS

Ps great answer Sebo and Chicagoan...
LVL 18

Expert Comment

ID: 9934793
That's about the most practical work-around, run a cron job to flag them RO or take ownership with cacls.
If you can get your checkbook and head around a proper document management system you won't be sorry.


Author Comment

ID: 9935049
Sorry Chicagoan......what is "cron job"  and also "calcs"? Also, can you reccomend a documnet managment system?


LVL 18

Expert Comment

ID: 9935091
Document management systems:
If you're using Autocad, you should visit
Sharepoint is Microsoft's offering.

Windows includes a task scheduler
cron is a scheduler ported from unix, try the above to see if it works for you first.


Display or modify Access Control Lists (ACLs) for files and folders.

Access Control Lists apply only to files stored on an NTFS formatted drive, each ACL determines which users (or groups of users) can read or edit the file. When a new file is created it normally inherits ACL's from the folder where it was created.

      CACLS pathname [options]
      CACLS pathname
key   options can be any combination of:   /T Search the pathname including all subfolders.
   /E Edit ACL (leave existing rights unchanged)   /C Continue on access denied errors.
   /G user:permission      Grant access rights, permision can be:          R Read
         C Change (write)
         F Full control
   /R user      Revoke specified user's access rights (only valid with /E).
   /P user:permission         Replace access rights, permission can be:          N None
         R Read
         C Change (write)
         F Full control
   /D user Deny specified user access.    In all the options above "user" can be an NT Username
   or an NT Workgroup (either local or global)

   If a username or groupname includes spaces then
   it must be surrounded with quotes e.g. "Authenticated Users"

   If no options are specified CACLS will display the ACLs for the file(s)
Other features to try

Wildcards can be used to specify multiple files.
You can specify more than one user:permission in a single command.
The /D option will deny access to a user even if they belong to a group that does have access.


The CACLS command does not provide a /Y switch to automatically answer 'Y' to the Y/N prompt. However, you can pipe the 'Y' character into the CACLS command using ECHO, use the following syntax:

ECHO Y| CACLS /g <username>:<permission>

To edit a file you must have the "Change" ACL (or be the file's owner)

To use the CACLS command and change an ACL requires "FULL Control"

File "Ownership" will always override all ACL's - you always have Full Control over files that you create.

If CACLS is used without the /E switch all existing rights on [pathname] will be replaced, any attempt to use the /E switch to change a [user:permission] that already exists will raise an error. To be sure the CALCS command will work without errors use /E /R to remove ACL rights for the user concerned, then use /E to add the desired rights.

The /T option will only traverse subfolders below the current directory.


Adding new file permissions to a group of users
CACLS myfile.txt /E /G "Power Users":F

If we now grant Read permissions to the same group they will still have FULL control
CACLS myfile.txt /E /G "Power Users":R

This command will replace the first ACL granted and allow only Read access:
CACLS myfile.txt /E /P "Power Users":R


Author Comment

ID: 9935799
Wow.......Fantastic answer Chicargo......It is going to take me a little while to understand this, but am giving it a go.....Thanks again, i'll let you know how i get on. Sean

Author Comment

ID: 9936924
On allmost the same subject......Is there a way of locking folders?....I mean some kind of password protection that one unlocks at the start of the day and then locks again when one has finished work. The files then being protected in case of ever being stolen?
LVL 18

Accepted Solution

chicagoan earned 500 total points
ID: 9937355
Files ARE locked, more or less, until you log in.
XP automates the login process for you but it doesn't have to be that way.

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Join Greg Farro and Ethan Banks from Packet Pushers ( and Greg Ross from Paessler ( for a discussion about smart network …
If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question