Part 10 · Windows Security

Chapter 25 · Windows Permissions

2 min read

Status: ✅ COMPLETE

Scope: How Windows decides who may open, change or delete a file: NTFS and share permissions, inheritance, effective permissions, ownership, special accounts, UAC, and why even administrators are blocked from some system files
Time to complete: 90–120 minutes of reading + lab
Prerequisites: Chapter 17, Chapter 19 (NTFS), Chapter 21 (system files), Chapter 24 (authentication, tokens and SIDs)
What you'll know after: How to read any ACL, why a user gets "access denied", how share and NTFS rules combine, how UAC protects an administrator, and how to stay safe around TrustedInstaller files

INTRODUCTION

Every file on a Windows PC is guarded by a guest list. Chapter 24 showed how Windows knows who you are (your token and SIDs). This chapter shows what Windows does next: it compares your token with the guest list on the file, and decides yes or no.

This chapter uses tables and simple diagrams instead of photos, and plain words. Every technical term is explained the first time it appears.

This chapter explains:

  • The NTFS permissions: Full control, Modify, Read & execute, Read, Write and the special rights beneath them
  • Share permissions for network visitors, and how they combine with NTFS (the stricter wins)
  • How rules flow down from folders to files (inheritance) and how to break the flow
  • How Windows adds up your groups into effective permission, and why Deny wins
  • What an owner is and how ownership is taken
  • The special accounts you see in every ACL: SYSTEM, Administrators, TrustedInstaller and more
  • UAC: why an administrator has two tokens, and what the prompt is doing
  • Why an administrator can still get "You need permission" on files in C:\Windows

CHAPTER OUTLINE

Chapter Status: Complete
Estimated reading time: 100 minutes
Practical time: 35 minutes
Knowledge check time: 30 minutes