NTFS Permissions, Full Control but not Full Control

Hiya.

We've got a user with a bad habit of dragging and dropping folders into other folders on shared department drives. We want this user to have read/write control over the documents for editing, but not be able to change the folder structure. Is there an NTFS permission category that does this, or would I need to set the permissions on folders to read-only, then set the documents within those folders to full control? This may be a very basic question, but it's not something I've come across before.

Thanks in advance!
-pete

I've actually thought of doing something like this for the very same reason, but I didn't know where to start. Maybe someone has something that can help both of us. Maybe I'll have to tinker around tomorrow and see what I can come up with...

Under advanced security settings there is an option for creating or deleting folders.

I can't remember what the security tab looks like in NT 4.0 world, but in 2000 and 2003, if you click on the "Advanced" button at the bottom of the security tab, you can set permissions within the share. It might be a lot of work on your end, but what you can do is edit the permissions to "This Folder Only" for each folder in the share. He will be able to add, edit, write to documents and folders within the shared folder. Since permissions are for this folder only, that will keep each folder in place, as he doesn't have permission to move the folder out.

You will likely need to remove the check from the "Allow inherited permissions..." box. In 2000 it's on the security tab. In 2003, it's under the "Advanced" button. A box comes up giving you some advice. I select the "Copy" option each time I do this so that I don't lose permissions, and then I can edit them if they have been inherited from a folder above.

Don't forget to check the box "Reset permissions on file objects...blah, blah blah" after you've set the permissions on those folders.

Lots of work, but keeps things in their place.