Security – NTFS allow Read/Write/Modify, but not Copy

My approach is to not use file/directory level file permissions; use file share level permissions, and set the whole server filesystem data drive to Everyone Full Control (which becomes moot).

Over the years (10+), I have found that NTFS permissions are more complex and leads to more errors. If the permissions are set wrong, or the inheritance gets broken, you expose data and its hard to find and see it. Plus, you are exposed to the move/copy problem as you say.

Places where you have to use directory/file level ACL's; I know of no other solution than health checking the thing on a regular basis.

This can be done by modifying the advanced security permissions of the folder and make sure that the users do not have the "Delete Subfolders and Files" and "Delete" permissions. The following rights should work:

• Traverse Folder/Execute File
• List Folder/Read Data
• Read Attributes
• Read Extended Attributes
• Create Files/Write Data
• Create Folders/Append Data
• Write Attributes
• Write Extended Attributes
• Read Permissions

Here is useful article http://www.windowsecurity.com/articles/Understanding-Windows-NTFS-Permissions.html