>Put all of your data files in a data\ folder, and give those permissions only on that folder. You can run a background process to report any unexpected files that appear there, or simply auto-delete them.

We have multiple folders and multiple applications, in this particular case we gave access to users of our parent company, and for they are users of a different domain, permissions were given to a group and people from this other domain are put on that group, and we wanted to specifically avoid giving permission to the whole folder as there are other files that we did not want to share in the same folder. We have policies in place on the folders which, for example, prohibits someone creating a spreadsheet on the whole drive, so now if someone tries they get an error and the domain admins get an e-mail warning about the attempt, so we can inform them to use the proper location :)

>Do you have a utility that can rebuild the .CDX files while they are in use? We could use one of those in one of our projects.

No, we have a maintenance window where we kick everyone out of our applications, they first get a warning about the incoming maintenance asking them to close the applications before the time arrives, if they do not, then the application closes by itself, and will not start back until we finish.