Section 1: NTFS Permissions

The Big Picture: Who May Do What to This File?

Every file and folder on an NTFS drive has a guest list attached to it. The guest list says who may do what. When you try to open, change or delete something, Windows checks the guest list first. If your name (or a group you belong to) is not allowed to do that action, you get the message "You need permission to perform this action".

Two words you must know:

• NTFS is the file system Windows uses on its drives (Chapter 19). It can store extra security data for every file. FAT32 and exFAT cannot, so USB sticks formatted that way have no permissions at all.
• ACL (Access Control List) is the guest list itself. It is a list of entries. Each entry is an ACE (Access Control Entry), such as "the group Users may Read". Chapter 24 explained how ACLs and ACEs work inside. Here we look at what they mean in daily use.

  File: Report.docx
  ┌──────────────────────────────────────────┐
  │ Owner: Harshil                           │
  │ ACL (the guest list):                    │
  │   ACE 1: Harshil          → Full control │
  │   ACE 2: Administrators   → Full control │
  │   ACE 3: Users            → Read         │
  │   ACE 4: Guests           → Deny: Write  │
  └──────────────────────────────────────────┘

Who is on the list? Each entry names a security principal: a user, a group, or a special account. Windows stores it as a SID (Security Identifier), a long unique number. The name you see in the dialog is just a friendly label for that number.

1.1 Read, Write, Execute, Modify, Full Control

What it is: Windows groups the many small file actions into a few standard permissions you see in the Security tab. They are easy to read and cover almost all daily needs.

Where to see them: Right-click a file or folder, choose Properties, open the Security tab. Click a name in the top box. The bottom box shows what that name is Allowed or Denied.

The six standard permissions for a folder:

Stacking up. Each level includes the ones below it:

Full control
   └─ includes Modify
        └─ includes Read & execute
             └─ includes Read
        └─ includes Write

So "Modify" is "Read & execute" + "Write" + the right to delete. "Full control" is "Modify" + the right to change permissions and take ownership.

What "execute" means. Executing a file means running it as a program. If a program file has no execute permission for you, double-clicking it fails. Scripts and .exe files need it. Plain documents do not.

Read & execute vs List folder contents. They look almost the same. The difference: List folder contents applies only to folders and does not pass down to files. Read & execute passes down to files too. This is why you see only Read & execute on a single file.

Allow and Deny. Each permission has two boxes: Allow and Deny.

• Allow adds a right.
• Deny takes a right away, and it always wins over an Allow (Section 4 explains why).

Use Deny rarely. Most of the time, simply not allowing something is enough, because anything not allowed is refused anyway.

Applies to. A permission on a folder can reach different things. You see this in Advanced:

Windows tip: To look at a folder's permissions without opening any dialog, open Command Prompt and type icacls "C:\Users\Public". You will see lines like BUILTIN\Administrators:(OI)(CI)(F). The letters are short codes:

1.2 Special Permissions (Granular)

What it is: The six standard permissions are really bundles. Under them sit 13 small, fine-grained permissions called special permissions. Windows lets you set them one by one when the bundle is too coarse.

Where to see them: Security tab → Advanced → pick an entry → Edit (or Show advanced permissions). You get a list of tick boxes.

The special permissions:

(The Security tab also shows Synchronize. It is a technical right used when programs wait for a file operation; you rarely touch it.)

How the bundles are built. For example, Read is made of: List folder / read data, Read attributes, Read extended attributes and Read permissions. Modify is almost everything except Delete subfolders and files, Change permissions and Take ownership.

A real use for fine-grained rights: a drop box. Imagine a folder where colleagues may add files but not see or change what others added. Give them Create files / write data and Create folders / append data, and nothing else. They can drop things in, but not read or delete.

Traverse folder: the quiet one. Suppose you may open D:\Data\Projects\Mine but not D:\Data itself. Can you still reach it by typing the full path? Yes. The right Traverse folder lets you pass through a folder on the way down. By default, ordinary accounts hold a privilege called "Bypass traverse checking" (Chapter 24 explains privileges), so you can usually walk through parent folders you could not list.

A common surprise: delete without a Delete right. You can delete a file if either of these is true:

1. The file itself gives you Delete, or
2. The parent folder gives you Delete subfolders and files.

So a file can look protected, and yet be deletable through its folder.

Can I delete Report.docx?
        │
  File gives me Delete?  ──yes──► deleted
        │ no
  Folder gives me "Delete subfolders and files"? ──yes──► deleted
        │ no
        ▼
  Access denied

Windows tip: Do not use special permissions unless you need them. A long list of tiny rules is hard to understand later. When in doubt, use the standard bundles.

Summary