Block copy files From File Server to Desktop

Question

Hi,

Here in my company I installed a File Server with old files (oldest than 2019), and I need to available these files for a consult for all employees. However, these files mustn't be copied by any user into their desktops (without change permissions). In short: this File Server will be an Archive server. Is it possible?

Thank you.

Answer 1

To expand on DSPatrick's comment, if you allow the users to run Word/Excel on their desktop and read the documents through a file share, then they can do a "file save as" and put it anywhere that their account has write access. Or just use the Explorer and do a copy/paste. You can't stop it if the user has read access.

You have to eliminate the file share from the data access path.

I don't know if any exist, but one thought would be to investigate some 3rd party software that implements a "display only" flavor of Word/Excel in a browser. The users would log on to a web site, select the folders and view the files. The users would be able to see the data but there would be no "save as" option to copy the data. Your organization may have to write your own web application to accomplish that. The web app would need to run on the archive server so that the file can be accessed directly and not through a file share.

Do you have Citrix or a Terminal server where you can publish applications? I am not an expert with MS Office applications, but I would expect that there is some way that you could customize the menu and remove "save as". Turn the archive server into a terminal server and run the published "no save as" versions to allow users to read the data through the published apps.

You could also enable RDP to the archive server and install Office there. Again, you would remove the network share and the users would directly access the file system. You would need to implement firewall rules to block SMB access from the archive server to other file servers and the users desktops.

Answer 2

If you grant read permissions to a file, you also grant the permission to copy it.

--please don't forget to Accept as answer if the reply is helpful--

Answer 3

Hi,

Please check if below post is similar with what you require.
https://serverfault.com/questions/727614/windows-server-share-read-only-from-network-and-write-locally

Otherwise, you might need to search for some third-party softwares to achive your requirement.

Thanks,

Eleven

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 4

Hi guys,

Thank you for your answers.

@Eleven Yu (Shanghai Wicresoft Co,.Ltd.) ,

I did it in the folders in my File Server, and it works almost fine. The thing is: with this configuration, people in the company I work for can read the docs, but they can't copy their files into their own directory (or whatever directory inside the Archive server). However, they can copy their files to their desktops, or even to another File Server in the environment. This is the thing. I don't wanna allow these copies. The Archive server must be used only for consults. And, this is the issue: each folder has permissions from different departments. Because of it, NTFS permissions must be kept, and copy operations must be denied. That is the scenario, and I don't know how to achieve this...I think I'm almost there...

Thank you.

Answer 5

Hi everyone,

@MotoX80 ,

Thank you for answering. I thought that could be easier...

Ok, I'll try to find another way.

Thank you.