Windows – Authenticated Users group in Windows 7

In Windows a file generally gets its ACL from the folder in which it is created. If the folder allows non-owners of files to delete them, then they can even if the owner is an administrator.

As you note you can change this for a file, a folder or a folder tree.

To change for all folders you need to first identify which folder trees you want to change (e.g. you shouldn't start changing permissions of C:\Users, C:\Windows, ... and other system folders).

Then for each of these you need to modify the ACL. This can be done in code or script (e.g. PowerShell), but needs more time to write up than I have now (if you just want to copy one ACL to another folder you can get-acl on the first and then set-acl on the other).

However I would suggest you consider why you want to do this. If a user needs to create files that only they can delete the best route is to create a folder, with specific ACL, for that purpose. Not to make some global change so the administrator doesn't have to think.

If the admin user should be able to edit many things, then admin should be a member of ville's group, not the other way around.

The way I manage users and groups is to give each user his/her own private group and set the default umask to 002 (you could do 007 if you want to make sure users cannot read each other's files by default as well). Then, when users need to be able to write to the same files, put them in a shared group, chgrp the directory to that group, and set the setgid flag on the directory (that will make sure any additional files or subdirectories created will have the same group).