Windows 7: Removing Folder Permissions

The Answer

The final answer it is control by UAC. If you don't want to be prompted then turn off UAC. Which is basically the 'toggle' that was asked about. This has been confirm though testing. Not to mention the UAC Shield Icon, that is on the Continue button when trying to access the folder, should have given it away from the beginning.

When clicking on a install/setup application or opening an application that requires admin access, the UAC prompt opens and ask for permission. Access a user folder isn't different. You need admin permissions just like installing an application. The only difference is, with UAC on, the accessing user will be added to the ACL of the user's profile folder. Which isn't the case when UAC is toggled off.

The reason for Microsoft change towards UAC is found with in this document: Understanding and Configuring User Account Control in Windows Vista. I know it says Vista, but they're one in the same when it comes to UAC. It seems it all comes down to the way UAC works.

The Fix...

I believe this will fix the issue. I can not be sure since I don't have the ability to test it out at this time. Please be careful and remember revert it back. You can open Command Prompt in Admin Mode, then type in the following :net user administrator /active:yes. Please reverse this action by changing yes to no when finish doing what you need to do. This will help with security.

The only fix is to turn off UAC.

Through a process of trial and error, I have found that by NOT granting 'Write Attributes', this has the effect of preventing a user from modifying/deleting existing files (which is what I want). However, I would really like an explanation as to precisely why this works.

This is a function of precisely how a file modification occurs. When you modify a file, the operating system doesn't actually modify the file you're editing. It replaces the file you're editing with the copy you changed. So, essentially, a file modification takes a copy of the original file, loads it into memory (where you modify it), deletes the original file, and creates a new file with the same name in the same place. This is why NTFS Delete permissions are required to modify files - in fact, if you check the Advanced permissions on an NTFS object, there is no Modify permission - a modification is really just a delete and a write.

So, in order to create that new copy of a file, it has to write the file attributes of this new file... and, of course, writing attributes requires the Write attributes NTFS permission. So that is why you can't modify a file without having the Write attributes NTFS permission.

Specifically, thanks to a chat with Fitzroy, the NTFS file attribute that needs to be written under the user's security context (that can't be, without the Write Attributes permission), when modifying a file, but not when creating a completely new one, would be the file's LastModificationTime. This is a part of the Standard Information attribute, according to one of the Microsoft Core Team developers.