# Prohibiting Container Deletion When Deletion of its Parent Container Contents Is Disabled

The following two security rules set different sets of access rights for a parent object (in this example, the `httpdocs` folder on domain `example.com`) and its child objects - subfolders and files contained in the folder. The resulting security configuration will prohibit deletion of the parent container by a domain user but will allow the user full control for files and folders contained in the `httpdocs` folder.

## Security rule entry 1

The following rule sets access rights to files in the `httpdocs` folder on domain `example.com` for the Windows user account named `domainuser1`, prohibiting deletion of the folder.

    <Entry AccounType="1" Account="domainuser1" SidStr="S-1-5-21-2767697126-2621801917-3613110436-1022" Path="[HTTPD_VHOSTS_D]" SubPath="example.com\httpdocs" AceFlags="ThisObjectOnly" AccessMask="FileNonRemovable" EntryFlags="0x140" Tag="DomainUser" Tag2="" /

### Explanation

Because the name domainuser1 is not a standard system account name, it has to be resolved in the system (hence, AccounType=”1”). The optional SidStr attribute is defined to improve Plesk stability. The HTTPD_VHOSTS_D component path in the Path attribute specifies the common part of the path to the domain root folder where the example.com folder is located. The SubPath attribute completes the path to the httpdocs folder to which the rule will be applied. AceFlags=”ThisObjectOnly” specifies that, according to this rule, an ACE with permission defined by AccessMask=”FileNonRemovable” will be created and added only to the httpdocs folder on domain example.com. EntryFlags=”0x140” enables (i) creation of the folder (which is necessary during domain creation), (ii) strict enforcement of the access permissions defined by the AccessMask= `"FileNonRemovable"` permission mask, and (iii) sets the ACE type to Allow Access. Tag=”DomainUser” designates the security rule as pertaining to a domain hosting account and is used by Plesk to properly organize the processing of security metadata.

## Security rule entry 2

The rule sets full control rights to the `httpdocs` folder, its subfolders and files on domain `example.com` for the Windows user account named `domainuser1`.

    <Entry AccounType="1" Account="domainuser1" SidStr="S-1-5-21-2767697126-2621801917-3613110436-1022" Path="[HTTPD_VHOSTS_D]" SubPath="example.com\httpdocs" AceFlags="SubfoldersAndFilesOnly" AccessMask="FullAccess" EntryFlags="0x140" Tag="DomainUser" Tag2="" />

### Explanation

Because the name `domainuser1` is not a standard system account name, it has to be resolved in the system (hence, `AccounType="1"`). The optional `SidStr` attribute is defined to improve Plesk stability. The `HTTPD_VHOSTS_D` component path in the `Path` attribute specifies the common part of the path to the domain root folder where the `example.com` folder is located. The `SubPath` attribute completes the path to the `httpdocs` folder to which the rule will be applied. `AceFlags="SubfoldersAndFilesOnly"` specifies that, according to this rule, an ACE with permission defined by `AccessMask="FullAccess"` will be created and added to the `httpdocs` folder and all of its subfolders and files on domain `example.com`. `EntryFlags="0x140"` enables (i) creation of the folder (which is necessary during domain creation) and (ii) strict enforcement of the access permissions defined by the `AccessMask="FullAccess"` permission mask. `Tag="DomainUser"` designates the security rule as pertaining to a domain hosting account and is used by Plesk to properly organize the processing of security metadata.