I am setting up a set of scan folders from a scanning copier device, and would like to know the best way to protect the folders (for each department) from moving or deletion, but yet still allow access for the users to modify (i.e. create/add/delete) the scanned files within the folder.

Structure is: Share Name > Departmental Folder > User files

The writing of the files initially is taken care of by a service account which has full control. We'd just like to ensure the users cannot accidentally delete the folder (which has already happened) containing all the files, etc.

This is for a Windows 2003 server, NTFS permissions.

Suggestions would be most appreciated.