Re: NTFS Drop Folder - Blocking Owner from changing files

"Sebastian G." <seppi@xxxxxxxxx> wrote in message
news:69f5vuF32kbsvU2@xxxxxxxxxxxxxxxx
neo [mvp outlook] wrote:

Let me rephrase... your right, they retain Owner on the ownership tab,
but it is possible to allow write once and ensure that with propert ntfs
acls, that they can't change, read, delete, .etc.


Discretionary access control is actually defined as hat the security of an
object is under the discretion of the owner.

Yes, but Windows can now approach mandatory access control
with its DACLs (search on Owner Rights).
But, here access is apparently via network share, so the
use of higher permissions even if owner grants it to self
can be limited via the share permissions.
Also, if storage is on newer Windows version Owner Rights
grant could be used to prevent exercise of owner's default
ability to change ACLing.
Removal of Creator Owner ACEs from ACL if any is IMO
a good thing in this scenario in any event. Not that it makes
things harder (use owner's default abilities if allowed) so
much as it makes things look like what you intend and it is
a go/no go on having ABE do its masking.


.

Relevant Pages