File Permissions: Edit, Print, NO SAVE?

I have a Excel sheet that I have on our file share for our facility. I want the users to be able to edit the document, but I don't want them to save it or a copy of it, and I want them able to print the file however.

I'm pretty familiar with NTFS, as I set up the entire structure for our facility...but it's been a while and I'm rusty.

Any quick answers? Anyone know which permissions will give me the ability to do this?

Who is Participating?
Michael PfisterCommented:
You can protect the document from being written/deleted by setting its (or the folder containing the file) permissions to R(ead) & X(ecute). Users can open and print ist.

But its not possible to prevent them from copying it to a different folder.
David Johnson, CD, MVPOwnerCommented:
The old file save as will get you every time.
Syed_M_UsmanSystem AdministratorCommented:

the Direct answer is NO,,, but there is a way you can do

in that case you can share file to a Secure computer, with ONLY Network Printer installed.... Allow users to remote in to dekstop,,,, Edit and Print but the session should not allow copying from and to the local machine.....

in order to restrict all users in domain you may need to use GPO for this,
Group Policy (gpedit.msc) >
Computer Configuration >
Administrative Templates>
Windows Components >
Terminal Services >
Client/Server data redirection >
Do not allow drive redirection & 
Do not allow clipboard redirection

NOTE: please mae sure you test all above steps in TEST ENVOIRMENT or atleast create seprate GPO for this and test on 1 or 2 computer berfore you do in production env.....
Simple Misconfiguration =Network Vulnerability

In this technical webinar, AlgoSec will present several examples of common misconfigurations; including a basic device change, business application connectivity changes, and data center migrations. Learn best practices to protect your business from attack.

Rob WilliamsCommented:
It is possible to disallow someone to save a document in a given folder but as mentioned by another they can use save as or save to a different folder.

Microsoft has designed the Information Rights Management service specifically to meet your requirements.  It allows you to manage access to and the flow of documents.  You can control the following attributes; Full Control, View, Edit, Save, Extract, Export, Export, Print, Allow Macros, Forward, Reply, Reply All, View Rights.

As a result you can allow a person to edit a document and print it, but not save it, forward it, or copy it.  It allows for very controlled permissions that stay with the document.  For example you may have a document you want one user to read. They can do so but if they forward it, the recipient cannot.  

It requires an authentication system, and there are 2 options; an internal RMS server, or you can simply use Windows live ID’s.  The following is a detailed article outlining Information Rights Management.

This link is a video demo using an Excel spreadsheet.

Though the links reference Office 2010, IRM existed back as far as Office 2003.  Implementation may be a little different on older versions.

Adobe also offers different document protection software.  Adobe is common for forms where you fill out the form and print, but you cannot save.
btanExec ConsultantCommented:
when you save changes to an excel file, excel first creates a temporary file, then deletes the original , then renames the temporary file to match the original name. So if we can deny delete permission, it may work to prevent saving but still allow edits. There is  Advanced Permissions like possibly can be set to Deny to Delete and Delete Subfolders and Files. Definitely also not Full control except for owner of the xls.

As for printing, I supposed the xls can already print :)

Just a side note - Actually XLS' shared worksheet capability may give the granular control of the user etc but it doesnt really restrict saving unless you state worksheet protection but if the password is known, it wouldnt make a difference then. I may be wrong but  NTFS level can be tighter. Eventually I still think RMS will be the eventual choice to go for enterprise deployment to really manage the permission per doc etc
Rob WilliamsCommented:
Agreed deny delete blocks saving, it's actually a common complaint, but only blocks on the folder to which you apply the restriction.
Pancake_EffectAuthor Commented:
Shame there is no easy way of going about it. Thanks for the insight everyone.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.