Question : Windows equivalent to Netware _RW_C_F_ permission (add but not modify)

I'm trying to figure out how to set up a share that has a HUGE amount of archived data in it.
It consists of 25,000 base directories, a directory structure of 15 or so directories under these, and then a total of close to a Million files spread all over the place.

As an archive, I  allow users to read existing files but not modify or delete them.  They can also create additional files.
(Netware folder rights: Read, Write, Create, Filescan checked but NOT Execute or Modify)
How on earth can I achieve this in Windows???

As soon as I assign rights to write, an existing file can be modified, you can stop it being deleted, but that's hardly a consolation if the file is no longer "valid".

What hoops or magic am I missing?

This seems to basic to not be possible!

Answer : Windows equivalent to Netware _RW_C_F_ permission (add but not modify)

That is a lot of files and directory access control lists that Windows is going to get to touch as you assign permissions.  Plan on the hour glass for a long time (at least that is my experience as I have a large archive with about 5,000 base directories and about half as many files).

I believe but am not able to test right now that you need to assign Read and Change as a Share Permission when you set up the share and then assign your user Read (which includes a "file scan" of sorts) Change (which is basically write, modify and create) don't assign Full Control nor add Delete.  You may want to look at Special permissions instead of using the ones in the first screen (Read, Change, Write, Execute, etc.).

As you've probably figured out Windows has two sets of permissions: share and NTFS File.  Used to be that the share would automatically provide Full Control to Everyone now with Win2k3 and later it appears that Everyone only gets Read and as I recall that will prohibit you from actually doing anything to files/directories within the share, even if you assign NTFS permissions (but again I'm not near a server to test this tonight and it has been a while since I assigned permissions like this).

Hope that helps.

Scott