Is there a way to LOCK the Windows Folder structure in place? Users I
administor are "click happy" and move files and folders all over the
file server. I want to lock ALL files/folders in place so users are
unable to move them (copying is okay). NTFS permissions ARE set on all
files/folders. With NTFS if i give someome read access to a file; they
can't move it, but at the same time they can't make changes to the
file. Users O/S is Windows XP, I'm using Windows 2003 server. Any
ideas or software? Thank You.

---

Clarification of Question by jokeradmin-ga on 04 Feb 2005 08:50 PST

The file structure is on a Windows Server.

why should they have any access at all to their desktop config? Set
them as "User" level on the XP (hopefully XP Pro), take a look at
group policies, and make their "My documents" point somewhere on your
domain server.

Except for some rather silly applications that must have admin access
to run, once the administrator of the pc has installed the apps, the
user should not need to touch the directory structure of C:. Further,
it is possible with the policy editor to remove C: as an available
letter to view, at least through the GUI. If you don't trust your
users, then don't give them any permission you don't want them to
have.

How does your recent clarification change the comment?

If you don't want the files to be moved, you restrict the possible destinations.

User has access to files in "FolderA" & "FolderB" (they need both
folders to do work) User moves file from "FOLDER A" to "Folder B" by
mistake. Then they can't find the file. (its a more complex structure
with multiple files, subfolders)

Simple example: 
\\server\foldera\somefile.doc is moved to \\server\folderb\ by mistake.

I'm trying to do is make it so the file(or folder) cannot be moved.
(but at the same time users should be able to make changes to it) With
NTFS permissions if you give a user just "READ" permission to a file
(or folder) then use cannot move it, But they are unable to make
changes to the file. If you give some access to change a file then
they can move it to where-ever the user has access to.

Apply the following security to the folders you woule like to restrict:

Deny Privileges
---------------
"Delete Subfolders and Files"
"Delete"

Allow Privileges
----------------
"Traverse Folder / Execute File"
"List Folder / Read Data"
"Read Attributes"
"Read Extended Attributes"
"Create Files / Write Data"
"Create Folders / Append Data"
"Write Attributes"
"Write Extended Attributes"

This will allow the user to be able to create files, make changes to
those files and copy the files, but not be able to delete or move the
files.