File Permissions: Edit, Print, NO SAVE?

Posted on 2012-09-18
Last Modified: 2012-10-02
I have a Excel sheet that I have on our file share for our facility. I want the users to be able to edit the document, but I don't want them to save it or a copy of it, and I want them able to print the file however.

I'm pretty familiar with NTFS, as I set up the entire structure for our facility...but it's been a while and I'm rusty.

Any quick answers? Anyone know which permissions will give me the ability to do this?

Question by:Pancake_Effect
    LVL 28

    Accepted Solution

    You can protect the document from being written/deleted by setting its (or the folder containing the file) permissions to R(ead) & X(ecute). Users can open and print ist.

    But its not possible to prevent them from copying it to a different folder.
    LVL 77

    Assisted Solution

    by:David Johnson, CD, MVP
    The old file save as will get you every time.
    LVL 16

    Assisted Solution


    the Direct answer is NO,,, but there is a way you can do

    in that case you can share file to a Secure computer, with ONLY Network Printer installed.... Allow users to remote in to dekstop,,,, Edit and Print but the session should not allow copying from and to the local machine.....

    in order to restrict all users in domain you may need to use GPO for this,
    Group Policy (gpedit.msc) >
    Computer Configuration >
    Administrative Templates>
    Windows Components >
    Terminal Services >
    Client/Server data redirection >
    Do not allow drive redirection &
    Do not allow clipboard redirection

    NOTE: please mae sure you test all above steps in TEST ENVOIRMENT or atleast create seprate GPO for this and test on 1 or 2 computer berfore you do in production env.....
    LVL 77

    Assisted Solution

    by:Rob Williams
    It is possible to disallow someone to save a document in a given folder but as mentioned by another they can use save as or save to a different folder.

    Microsoft has designed the Information Rights Management service specifically to meet your requirements.  It allows you to manage access to and the flow of documents.  You can control the following attributes; Full Control, View, Edit, Save, Extract, Export, Export, Print, Allow Macros, Forward, Reply, Reply All, View Rights.

    As a result you can allow a person to edit a document and print it, but not save it, forward it, or copy it.  It allows for very controlled permissions that stay with the document.  For example you may have a document you want one user to read. They can do so but if they forward it, the recipient cannot.  

    It requires an authentication system, and there are 2 options; an internal RMS server, or you can simply use Windows live ID’s.  The following is a detailed article outlining Information Rights Management.

    This link is a video demo using an Excel spreadsheet.

    Though the links reference Office 2010, IRM existed back as far as Office 2003.  Implementation may be a little different on older versions.

    Adobe also offers different document protection software.  Adobe is common for forms where you fill out the form and print, but you cannot save.
    LVL 60

    Assisted Solution

    when you save changes to an excel file, excel first creates a temporary file, then deletes the original , then renames the temporary file to match the original name. So if we can deny delete permission, it may work to prevent saving but still allow edits. There is  Advanced Permissions like possibly can be set to Deny to Delete and Delete Subfolders and Files. Definitely also not Full control except for owner of the xls.

    As for printing, I supposed the xls can already print :)

    Just a side note - Actually XLS' shared worksheet capability may give the granular control of the user etc but it doesnt really restrict saving unless you state worksheet protection but if the password is known, it wouldnt make a difference then. I may be wrong but  NTFS level can be tighter. Eventually I still think RMS will be the eventual choice to go for enterprise deployment to really manage the permission per doc etc
    LVL 77

    Assisted Solution

    by:Rob Williams
    Agreed deny delete blocks saving, it's actually a common complaint, but only blocks on the folder to which you apply the restriction.
    LVL 4

    Author Closing Comment

    Shame there is no easy way of going about it. Thanks for the insight everyone.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Should I Do With This Threat Intelligence?

    Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

    Ransomware continues to be a growing problem for both personal and business users alike and Antivirus companies are still struggling to find a reliable way to protect you from this dangerous threat.
    Join Greg Farro and Ethan Banks from Packet Pushers ( and Greg Ross from Paessler ( for a discussion about smart network …
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now