Topic: Permissions for write and not modify.

[Bryco]

We have a projectdata drive with job folders that include drawings, graphics and documents etc.
Project manglers need to be able to create subfolders but not move, delete the entire folder. I can't figure out how to set this without code, but I'm hoping someone knows how and then I will try to do it in code. We have lost entire jobs and our IT man hasn't been able to come up w/ a solution.

[uncoolperson]

could you set the security on files so they can't fool with them, but set the security on the directories so they can?

[huiz]

In Windows that is not possible. We also lost data because people accidentally move while doubleclicking in Explorer.

For AutoCAD you could use Vault, that is a document management program that looks like some Explorer but you can give rights to read and write on folders and files, also have automatically previous versions, etc. Else you can write your own Explorer-like dialogs where it is not possible to move or delete.

[pkohut]

In Windows that is not possible. We also lost data because people accidentally move while doubleclicking in Explorer.

For future reference, UNDO is available in Explorer for most operations. I've done the drag/move thing to some unknown folder and undo has worked.

[Kerry]

True Paul, but by the time most people realize they've fluffed it it's too late to undo.

[huiz]

Unfortunately the most of my colleagues don't even know what happened or that THEY did it

[Glenn R]

Bryco,

It's under special permissions for the security for the folder. From memory, Deny 'Delete Files' and 'Delete Folder'.
I've worked at places where the root project directory had special permissions like this. Users could create, files and sub-folders, write to them, but couldn't delete them, except their own.

This stopped that accidental drag and drop of a whole project somewhere else in the tree, which can be very annoying.

Cheers,
Glenn.

[Bryco]

Thanks, I'll p[lay with that. Write  without modify seems to be the  the permission I want but it wont allow me to check no modify and yes to write. Like you say the special permissions seem to have more options.
Did you set these for the drive or for each folder?

[Glenn R]

I didn't do this - it was the IT dept. I just vaguely remembered it form years ago and confirmed it briefly with someone at my present place of daytime habitation.

I think you try enabling most things, but specifically ticking deny delete - I think that will overwrite any inherited permissions or clashes. It was done on the 'project' root folder ie the folder on the drive that contains each project's folder and sub-folders...does that make sense?

If you get it sussed, post it back here as I'm not entirely sure of the specifics myself...was back in OZ...

[Bryco]

Good , I'll try that when I get to work

[Bryco]

Huiz, I haven't tried vault as I heard it was a memory hog and our server is pretty slow, do you like it?

[huiz]

Huiz, I haven't tried vault as I heard it was a memory hog and our server is pretty slow, do you like it?

No, not at all, but it was an option 

[Bryco]

I've finally had time to play with this.
It was no good trying to set permissions for the whole drive as Users need more permissions for specific folders.
Share is set to everyone full.
Cadusers and Users get readonly for the drive.
Then Cadusers get full control for each Job folder (Subfolders and files)
Users get full control for specific subfolders.

The code is simple to give the permissions

Code: [Select]

        private static void AddFullcontrol(string sFolder, string sAccount)
        {
            Document doc = acadApp.DocumentManager.MdiActiveDocument;
            Editor ed = doc.Editor;
            bool bMod;
            AccessControlType allow = AccessControlType.Allow;
            InheritanceFlags inherit = InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit;
            PropagationFlags pInherit = PropagationFlags.None;
            if(sAccount==@"LEX\CadUsers")
                pInherit = PropagationFlags.InheritOnly;

            FileSystemRights fullcontrol = FileSystemRights.FullControl;
            DirectoryInfo DirInfo = new DirectoryInfo(sFolder);
            DirectorySecurity dSecurity = DirInfo.GetAccessControl();
            FileSystemAccessRule fsaWrite = new FileSystemAccessRule(sAccount, fullcontrol, inherit, pInherit, allow);
            dSecurity.ModifyAccessRule(AccessControlModification.Add, fsaWrite, out bMod);
            DirInfo.SetAccessControl(dSecurity);
            ed.WriteMessage(Environment.NewLine + sFolder + "=" + bMod.ToString());

        } // end AddFullcontroland since I make the folders, I add the permissions as I make them.

The hard part was the folder on the drive bought permissions with it that never showed up, so whatever I did didn't work until I unticked inherit from parant and made a copy.