I’ve been trying to use the Windows 10 icacls utility to do this. I did some searching here, and I found this, but it doesn’t my specific question. I tried adding a comment to this question, but I don’t have enough reputations.
As an administrator on my Windows 10 Professional machine, I want to prevent local users from deleting executable programs, while still providing executable access (like the Linux chmod rx command). I’ve set the file owner to Administrator. I’ve been trying to achieve this using the utility, as follows.
For the specified (non-administrator) user, the following all prevent the file being deleted, but also disable executable access
- icacls /deny user:W
- icacls /deny user:M
- icacls /deny user:(D)
- icacls /deny user:(WO)
- icacls /deny user:F followed by /grant user:(RX)
The following allows executable access, but also allows the file to be deleted
- icacls /deny user:(WDAC)
Is what I’m trying to do even possible? It seems that executable and write access are identical?
