<div>
Run icacls on the file within the share on the server where it is being shared.<br />
Add a rule denying the delete right to domain users. A user that is not a member of the domain users group will be permitted to delete.<br />
<br />
The delete deny right will supersede and be enforced no matter what additional groups the user is a member of and what rights exist there.<br />
Removing a right to delete from one group, does not deny a user who might be a member of another group where the delete right is still present.<br />
Enable share auditing to record which users deletes the file.note this will add many entries into the security event log on the server.
</div>


JohnPaddock

<div>
Thanks, below is the icacls<br />
It appears your sentence about the 'delete deny right will supersede' doesn't seem to be what I'm finding, although it is what I would expect to occur.<br />
I enabled share auditing, but I'd still like to know why I can't deny users from deleting these files. &nbsp;Maybe it's because they have full control of the folder that the file is in. &nbsp;If anyone feels like experimenting in their own environment, I'd be curious if they find the same thing<br />
<br />
icacls test.txt<br />
<br />
test.txt MXX\Domain Users:(N)<br />
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;BUILTIN\Administrators:(F)<wbr /><br />
<br />
Successfully processed 1 files; Failed processing 0 files
</div>


<div>
An account that is not a member of the domain users group but is a member of domain admin's. Is permitted to delete the file.<br />
Domain admin's, etc. are members of the built-in\administrators group.<br />
<br />
Properties, security, advanced, effective, you can check which rights a specific user has.<br />
Add deny delete right to the administrators group and see if that changes.<br />
<br />
Try this, add e everyone group with only deny delete right.
</div>


<div>
the question is on restricting rights to a user on a file. Log off/logon unnecessary in these types of scenarios.
</div>


Network Engineer 

kevinhsieh

<div>
If a user has full control they can modify the ntfs permissions and delete the file. &nbsp;if it is ONE file remove ownership and only allow READ.. explicit deny overrides the allow permission.
</div>


<div>
Thanks for the replies<br />
Arnold, the user in question isn't a domain admin.<br />
The effective rights show the user with all red X's.<br />
I added the deny delete right ot admins, didn't help<br />
Added everyone group with deny delete, didn't help<br />
<br />
To HelloThere, users don't need to log off when applying permissions. &nbsp;They do need to log off/on when changing group membership though, for that to affect permisions.<br />
<br />
DavidJ, I tried that, but user is still able to delete the file. &nbsp;It doesn't appear that explicit deny delete is over-riding anything.<br />
<br />
Kevinhsieh, I set the file to read-only, and that seems to work, but doesn't make sense, but it does seem to work. &nbsp;Thankyou.<br />
<br />
I'd still like to understand why this doesn't work. &nbsp;Could someone try this in your environment, just to see if it's the same everywhere?<br />
<br />
Give everyone full control to a folder.<br />
Put a file in the folder and deny everyone all access.<br />
See if a regular user can still delete the file. &nbsp;Maybe that's just the way windows works.
</div>


<div>
if the user has no rights on the file, the user would then not be able to delete the file. Something else is in play or you have another set of means by which users are provided access and that specific method does not use user rights but is preset.<br />
If everyone group is set to deny delete, the deletion should not be permitted. when tried it should error out with message permission denied.<br />
<br />
Just tested this on a windows 10 workstation. and the deny rule does not bar the deletion of the file.<br />
create a new file, set permissions by adding everyone group with a deny delete rights.<br />
this is not how it supposed to behave.<br />
<br />
It is a bug.
</div>


<div>
I've used on the directory level, but that bars all file modification not a granular as the person is looking for. It would seem the suggestion provided earlier to make the file read-only is the only remaining option. but a user with rights intent on deleting the file, could switch the read-only .....
</div>


<div>
No, users can't change the read-only attribute, it says access denied. &nbsp;So setting it to read-only actually works.<br />
<br />
I see that the folder permissions include 'delete subfolders and files'. &nbsp;But I want users to be able to delete newly created subfolders and files, so I can't remove that, since then new files won't inherit that permission and won't be deletable.<br />
<br />
Why would microsoft add that delete permission option to file security if it has no effect. &nbsp;There must be more to this story. &nbsp;<br />
<br />
I was thinking this is a bug, but windows7 does the same thing. &nbsp;I don't understand but at least we have solution.<br />
<br />
Thanks for the help everyone
</div>


<div>
likely the display of available option is not dynamically checked to see whether the option applies<br />
the display is the generic used for all objects within the file system.<br />
<br />
note denying delete on the folder level will mean that no file can have their names changed if i recall correctly.
</div>


<div>
MS has a feedback hub that people could use to provide suggestions regarding this or any other issues you might have<br />
<a href="https://t.co/u5o6skPtof?amp=1" rel="ugc">https://t.co/u5o6skPtof?amp=1</a>
</div>


<div>
<div class="content wysiwyg-content">
I can't seem to take away users rights to delete a file.<br />
I have a network folder that has 'domain users' full rights.<br />
I want to make it so 1 file in that folder cannot be deleted.<br />
I've tried removing 'domain users' rights completely, yet they can still delete the file.<br />
I've tried adding 'domain users' and selecting 'deny' for all rights, and a user can still delete the file. <br />
I don't want to change permissions on the folder since I want users to be able to do anything in the folder, except for deleting this 1 file.<br />
What am i missing. (sever16 and Windows10)
</div>
</div>


I can't seem to take away users rights to delete a file.
I have a network folder that has 'domain users' full rights.
I want to make it so 1 file in that folder cannot be deleted.
I've tried removing 'domain users' rights completely, yet they can still delete the file.
I've tried adding 'domain users' and selecting 'deny' for all rights, and a user can still delete the file. 
I don't want to change permissions on the folder since I want users to be able to do anything in the folder, except for deleting this 1 file.
What am i missing. (sever16 and Windows10)

Can't stop user from deleting a file

This topic area includes legacy versions of Windows prior to Windows 2000: Windows 3/3.1, Windows 95 and Windows 98, plus any other Windows-related versions including Windows Mobile.