Section 5: Permissions and Security

The Big Picture: The Guest List at the Door

Think of a building with a guest list at each door. The bouncer checks your name (or the group you belong to) against the list and decides: come in, or stay out. Every file and folder on NTFS has its own guest list. That is what lets one PC hold files for several people, while keeping each person's files private.

FAT32 and exFAT have no guest lists (Section 2). Anyone who can see the drive can open everything. This is one big reason Windows lives on NTFS.

5.1 NTFS Permissions (Read, Write, Execute, Modify, Full Control)

What it is: A permission is a rule that allows or blocks one kind of action on a file or folder for one user or group.

Users and groups. Windows knows people by user accounts (like Sam) and by groups (a named set of accounts, so you can give a rule to many people at once). Common ones:

The standard permission levels. Open a file, choose Properties → Security and you see these friendly names:

Behind these friendly names are about a dozen finer special permissions (such as "Delete subfolders and files" or "Read attributes"). The standard levels are just handy bundles of them.

Owner. Every file has an owner, usually the person who created it. An owner can always change the file's permissions. Administrators can take ownership.

Allow vs deny. A rule can allow or deny. Rules that deny win over rules that allow. If you are in a group that is allowed but also in a group that is denied, you are denied. Use deny sparingly; it is easy to lock yourself out.

View permissions yourself:

• File Explorer: right-click → Properties → Security tab. Click a name to see its Allow/Deny ticks.
• Command Prompt: icacls C:\Windows\notepad.exe
• PowerShell: (Get-Acl C:\Windows\notepad.exe).Access

Reading icacls output. Letters in brackets are short codes:

A line like BUILTIN\Users:(I)(OI)(CI)(RX) reads: "the group Users may read and run; this was inherited, and it applies to files and subfolders." The details vary per file on your PC.

5.2 ACL (Access Control List) Structure

What it is: The ACL is the guest list itself: an ordered list of rules attached to a file or folder. The part that lists who may or may not do things is the DACL (Discretionary ACL: "discretionary" means the owner decides it).

The list is stored in a security descriptor, which holds:

Because many files share the same rules, NTFS stores each distinct security descriptor once, in the metadata file $Secure, and each file's record just points to it (Section 4.1). That saves a lot of space.

How Windows checks you. When a program opens a file, the kernel gets your access token (a badge listing who you are and every group you belong to) and walks the ACL from top to bottom:

 You: Sam, member of Users + Everyone
 Wants: to WRITE to report.docx

 ACL on report.docx (checked in order):
   1. Deny   Guests        Write        (Sam is not a guest, skip)
   2. Allow  Sam           Modify  ◄── covers Write: ACCESS GRANTED
   3. Allow  Users         Read
   4. Allow  Administrators Full control

If no entry grants the action, access is denied by default. Deny entries are placed first so they win. The chain at work: the file system driver (Section 8) performs this check during the open request.

5.3 ACE (Access Control Entry)

What it is: One rule in the list is an ACE (Access Control Entry). Each ACE says: who, allow or deny, what, and how it spreads.

 An ACL (the list) made of ACEs (the rules):

 ┌──────────────────────────────────────────────────────┐
 │ ACL                                                  │
 │  ┌────────────────────────────────────────────────┐  │
 │  │ ACE 1: DENY   Guests          Write            │  │
 │  ├────────────────────────────────────────────────┤  │
 │  │ ACE 2: ALLOW  Sam             Modify           │  │
 │  ├────────────────────────────────────────────────┤  │
 │  │ ACE 3: ALLOW  Users           Read & execute   │  │
 │  ├────────────────────────────────────────────────┤  │
 │  │ ACE 4: ALLOW  Administrators  Full control     │  │
 │  └────────────────────────────────────────────────┘  │
 └──────────────────────────────────────────────────────┘

Each ACE contains:

Windows tools such as icacls and the Security tab translate SIDs back to names such as Administrators. You can see a raw SID if an account was deleted: the tab shows a long S-1-5-... string instead of a name.

5.4 Inheritance from Parent Folders

What it is: Making a rule for every single file would be unbearable. Instead, rules set on a folder are inherited by everything inside it, automatically. Create a new file in a folder and it gets its parent's rules.

C:\Projects              Allow: Team       Modify    (set here, explicit)
 └── Plan\                                           (inherits: Team can Modify)
      └── notes.txt                                  (inherits: Team can Modify)

To see it: In Properties → Security → Advanced, the Inherited from column shows where each rule came from. The Disable inheritance button is the "break" switch.

Order of checking: Explicit rules are checked before inherited ones. Deny comes before allow within each group. So a deny set directly on a file beats an allow inherited from its folder.

Safety tips:

• Do not change permissions on C:\Windows or C:\Program Files. Windows needs those rules to work and to stay safe.
• Avoid giving Everyone Full control to anything. It lets any account change or replace the file.
• The Administrators group can still fix permissions later, which is why a locked-out file can usually be recovered by taking ownership.
• This is separate from UAC (the "Do you want to allow this app" prompt). UAC decides whether your programs run with admin power; ACLs decide what a given identity may touch.

Summary