Practical Lab: Permissions Exploration

Objective

See permissions on your own PC: read an ACL in File Explorer and on the command line, check the Effective Access tab, spot a TrustedInstaller-owned file, compare a normal and an elevated window, and try a few small changes inside a test folder you create yourself.

Time: 30–40 minutes
You need: A Windows PC with an NTFS drive (the usual C:), and an account you normally use.

Safety rules for this lab

1. You only look at system folders (C:\Windows, Program Files). You never change them.
2. Every change happens only inside the test folder PermLab that you create in Documents.
3. If you ever lock yourself out of PermLab, see "Recovery" in Part 7. The worst case is that you take ownership of your own test folder.
4. Delete PermLab when you finish (see Clean Up).

What to Open

Part 1: Make the Test Folder

1. In File Explorer, open Documents.
2. Make a new folder named PermLab.
3. Open it and create a text file named note.txt (right-click → New → Text Document). Type a few words in it and save.

Find the folder's real path. In PowerShell type:

$lab = Join-Path ([Environment]::GetFolderPath('MyDocuments')) 'PermLab'
$lab

1. My PermLab path is: ________________

(If Documents is synced with OneDrive, the path will include OneDrive. That is fine.)

Part 2: The Security Tab and Advanced Window

Right-click PermLab → Properties → Security tab.

2. Which groups and users are listed? ________________
3. Click your own name. Which permissions are ticked? ________________
4. Are the tick boxes grey (inherited) or normal (explicit)? ________________

Click Advanced.

5. Owner: ________________
6. In the Permission entries table, what does the "Inherited from" column say for each row? ________________
7. Is "Include inheritable permissions from this object's parent" or the Disable inheritance button shown? ________________

Part 3: Effective Access

In the Advanced window, open the Effective Access tab.

1. Click Select a user, type your user name, click OK, then View effective access.

2. Look at the ticks and crosses.

3. Do you have Full control? Which items have a cross? ________________

4. Repeat for the group Users. Does it differ from yours? ________________

(This tab is a calculation from the ACL. It is a very good guide.)

Part 4: The ACL on the Command Line

Open a normal Command Prompt and run:

icacls "%USERPROFILE%\Documents\PermLab"

(If your Documents folder is on OneDrive, use the real path from Part 1 instead.)

10. Copy one line you see (for example your user name followed by (I)(OI)(CI)(F)). ________________
11. Which entries have (I)? ________________

Now the PowerShell view of the same thing:

(Get-Acl $lab).Owner
(Get-Acl $lab).Access | Format-Table IdentityReference, FileSystemRights, AccessControlType, IsInherited -AutoSize
(Get-Acl $lab).AreAccessRulesProtected

12. Owner: ________________
13. AreAccessRulesProtected (False means inheritance is on): ________________

Part 5: Look at a TrustedInstaller File (Look Only)

Do not change anything here.

icacls C:\Windows\System32\notepad.exe

14. Which accounts are listed, and what rights does BUILTIN\Administrators have? ________________

(Get-Acl C:\Windows\System32\notepad.exe).Owner

15. Owner (expected: NT SERVICE\TrustedInstaller): ________________

Do the same in File Explorer: right-click notepad.exe in C:\Windows\System32 → Properties → Security → Advanced. Click Cancel when you are done looking.

(If notepad.exe is not there on your Windows version, try cmd.exe in the same folder.)

Part 6: Your Token, Groups and Privileges

In the normal Command Prompt:

whoami /groups
whoami /priv

16. What is the Mandatory Label line? (Expected: Medium Mandatory Level) ________________
17. Does BUILTIN\Administrators appear? If yes, does it say "Group used for deny only"? ________________
18. How many privileges are listed by whoami /priv? ________________

Now open an administrator Command Prompt (UAC prompt appears, click Yes) and run the same two commands.

19. Mandatory Label now (expected: High Mandatory Level): ________________
20. Is Administrators now "Enabled"? How many privileges now? ________________

(If your account is a standard user, the UAC prompt asks for an administrator password. If you do not have one, skip the elevated part.)

Part 7: Try Changes Inside the Test Folder

A Deny test. In the normal Command Prompt, run these one at a time. Replace YOURNAME with your user name:

icacls "%USERPROFILE%\Documents\PermLab\note.txt" /deny YOURNAME:(W)
echo more >> "%USERPROFILE%\Documents\PermLab\note.txt"

21. What error did the second command give? (Expected: Access is denied.) ________________

Open note.txt in Notepad: you can read it but not save. Now remove the Deny, so everything is normal again:

icacls "%USERPROFILE%\Documents\PermLab\note.txt" /remove:d YOURNAME

(/remove:d removes only the Deny entries for that name.) Try the echo again; it should work.

Optional: inheritance. In File Explorer: PermLab → Properties → Security → Advanced → Disable inheritance → choose Convert inherited permissions into explicit permissions on this object. Look at the table again: the "Inherited from" column now says None. To restore, click Enable inheritance.

Optional: ownership (administrator window, test folder only).

takeown /f "%USERPROFILE%\Documents\PermLab\note.txt" /a
icacls "%USERPROFILE%\Documents\PermLab\note.txt"

(/a makes the Administrators group the owner. Check with (Get-Acl "$lab\note.txt").Owner. If you would like to restore your own name as owner, run icacls "...\note.txt" /setowner YOURNAME.)

Recovery, if you lock yourself out of PermLab:

Part 8: Look at Shares (Read Only)

Run in the normal Command Prompt:

net share

22. Which shares appear? Do you see C$, ADMIN$, IPC$? ________________

In PowerShell (an administrator window may be needed; if you see "access denied", re-run it elevated):

Get-SmbShare
Get-SmbShareAccess -Name "ADMIN$"

23. Which account has access to ADMIN$? ________________

Clean Up

When you have finished, delete the test folder. In PowerShell:

Remove-Item -Recurse -Force $lab

(Only run this if $lab still holds your PermLab path. Print it first with $lab. You can also delete the folder in File Explorer; it may need the Recycle Bin emptied afterwards.)

What Should Happen

• Part 2 and 4 show the same ACL in two ways, with your account at Full control (inherited).
• Part 3 shows full rights for you.
• Part 5 shows an owner of TrustedInstaller and only Read & execute for Administrators.
• Part 6 shows two different token states: Medium and High.
• Part 8 lists the default hidden shares.
• The Deny test blocks your write; removing it fixes it.

Interpretation Guide

Follow-Up Questions

1. In Part 2, why were your permissions on PermLab greyed out? Where did they come from?
2. In Part 5, if you became the owner of notepad.exe, why would that still not be a good idea?
3. Why does whoami /groups show Administrators differently in the normal and the elevated window?
4. In the Deny test, you could still read note.txt. Why?
5. Name two facts from this lab that you could not learn from the file name alone.