Here is the scenario.
I have users accessing a Windows 2000 NTFS share from across the network. Everyone has “List Folder Contents” at the root of the share. Off of the root, there is a directory called PROJECTS. Everyone is assigned “Modify” at the PROJECTS level with one exception…under advanced permissions, users are only allowed to delete subfolders and files but not the PROJECTS directory itself.
If a user goes to the root of the share, highlights the PROJECTS directory, and presses delete, all of the data will be deleted from the directory before they get an “Access Denied” error. Even if I place a directory under PROJECTS and explicitly deny the delete permission to the Everyone group, users can still empty the entire directory.
Is this by design, or is there any other way to restrict users from “accidentally” deleting all of the data in PROJECTS? I though a deny permission always overwrites an allow permission.