Chapter 25 · Windows Permissions

Knowledge Check

8 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What do ACL and ACE stand for, and how are they related?
  2. Name the six standard NTFS permissions on a folder.
  3. When two entries conflict (one Allow, one Deny at the same level), which wins?
  4. Which three levels do share permissions have?
  5. A user connects over the network. Share says Read, NTFS says Modify. What do they get?
  6. What does a greyed-out tick box in the Security tab tell you?
  7. What can the owner of a file always do?
  8. Which account owns most core Windows files?
  9. What are the two tokens an administrator gets with UAC on?
  10. Which whoami command shows the Mandatory Label (integrity level)?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. ACL and ACE

Access Control List and Access Control Entry. The ACL is the whole guest list; each ACE is one line in it ("this SID may do this").

2. Standard permissions

Full control, Modify, Read & execute, List folder contents, Read, Write.

3. Allow vs Deny

Deny wins at the same level. (An explicit entry is read before an inherited one, so an explicit Allow can beat an inherited Deny.)

4. Share permission levels

Read, Change and Full Control.

5. Share Read + NTFS Modify

They get Read, the more restrictive of the two.

6. Grey tick boxes

The entry is inherited from a parent folder. Change it at the parent, or disable inheritance.

7. Owner

Read and change the ACL (even if the ACL gives them nothing). That lets the owner put themselves back in.

8. Core file owner

TrustedInstaller (NT SERVICE\TrustedInstaller).

9. UAC tokens

A filtered (standard) token used by default, and a full (elevated) token used after consent.

10. Integrity level command

whoami /groups (look for the Mandatory Label line).

UNDERSTANDING QUESTIONS

Q1. Why does Windows store a copy of inherited entries on each child instead of looking up parents every time?

Answer Each item carries its complete list, so an access check is one lookup in one ACL. Reading every parent folder on every file access would be slow. The price is that Windows must update the children when a parent's rule changes.

Q2. Why is "Deny" often avoided, even though it always wins at the same level?

Answer It makes results hard to predict: a user who is in a denied group stays denied whatever else they belong to, and the reading order (explicit before inherited) can surprise you. Not granting access already means no access, so Deny is only needed to exclude someone from a group that has access.

Q3. Why is the share permission "Everyone: Full Control" often used together with strict NTFS permissions?

Answer Both lists apply to network users and the stricter wins, so a loose share does no harm. NTFS also works for people sitting at the PC, so one detailed list (NTFS) is easier to keep correct than two.

Q4. Why does an administrator have two tokens?

Answer So ordinary programs run with limited power. A virus in a normal program gets only the filtered token. Full power is used only after a visible prompt, which limits standing admin privilege. It reduces risk but is not a complete wall.

Q5. Why can an administrator still be refused access to a file in System32?

Answer The file is owned by TrustedInstaller, and the ACL gives Administrators only Read & execute. Permissions are checked against the ACL, not against the title "administrator". Windows Resource Protection also guards these files on purpose.

SCENARIO QUESTIONS (Troubleshooting)

S1. A user is in the groups Staff (Modify) and Contractors (Deny: Write) on a folder. What can they do?

Answer They can read, but they cannot write, create or change files. The Deny removes Write from the combined result. To fix it, remove them from Contractors (or remove the Deny).

S2. A shared folder lets a mapped drive user save files, but another user, who has Modify in NTFS, cannot. Where do you look?

Answer At the share permissions. If the share gives that user only Read, the network result is Read. Check Sharing → Advanced Sharing → Permissions, and compare with the NTFS Security tab (use Effective Access).

S3. You set "Disable inheritance → Remove all" on a folder and now nobody can open it. How do you recover?

Answer The owner can always change the ACL: open Properties → Security → Advanced and add entries. If you are not the owner, an administrator takes ownership (`takeown /f "" /r /a`) and then grants access with `icacls`. Next time use "Convert" first.

S4. A command window says "Access is denied" when writing to C:\Program Files, although you are an administrator. What is the first thing to try?

Answer Check whether the window is elevated. A normal window has the filtered token. Reopen it with **Run as administrator** and look at `whoami /groups` (Administrators should show "Enabled" and High Mandatory Level). If it is still blocked, the file may be owned by TrustedInstaller and should be left alone.

S5. A mapped network drive shows in your normal Explorer but is missing in the elevated Command Prompt. Why?

Answer The normal and elevated windows use different tokens, and each has its own set of drive letter mappings. Map the drive again in the elevated window, or use the full network path (`\\server\share`).

INTERVIEW QUESTIONS

I1. Explain the difference between share permissions and NTFS permissions.

Answer Share permissions (Read, Change, Full Control) are set on the share and apply only to network (SMB) access. NTFS permissions are set on files and folders, are fine-grained, and apply to everyone (local and network). Over the network both are checked and the more restrictive result applies.

I2. How does Windows work out a user's effective permission?

Answer It takes the SIDs in the user's access token (the user and all their groups) and walks the ACL, collecting the matching Allow entries (their union) and stopping if a matching Deny covers a right that is needed. Entries are read in order: explicit Deny, explicit Allow, inherited Deny, inherited Allow. If a needed right is never granted, access is denied.

I3. What is the difference between taking ownership and having permission?

Answer The owner can always read and change the ACL, but ownership alone does not grant access to the file's content. Taking ownership is allowed with the Take ownership permission or the take ownership privilege (held by Administrators). Usually you take ownership first, then edit the ACL to give yourself rights.

I4. What is a split token and what is an integrity level?

Answer With UAC, an administrator gets a filtered token (Medium integrity, Administrators set to deny-only) used by default, and a full token (High integrity) used only after the user approves an elevation prompt. An integrity level is a trust label on processes and files; a process cannot modify something at a higher level.

I5. Why is it risky to take ownership of C:\Windows?

Answer Core files are owned by TrustedInstaller and protected on purpose. Changing owners and ACLs can break Windows Update, cause `sfc /scannow` to report errors it cannot fix, weaken protection against malware, and in the worst case leave Windows unbootable. Use supported tools (sfc, DISM) instead.

PRACTICAL TASK

Build a "permissions cheat card" for one real folder. Make a test folder (for example under Documents). On one page, write: its owner, whether inheritance is on, which entries are inherited and which are explicit, and the effective access of your user and of the group Users (from the Effective Access tab). Then add one line: what would change if you added a Deny for Users: Write.

Why This Matters

When a person says "I cannot open my file" or "the shared folder is read-only for me", this is the checklist an administrator follows: owner, inheritance, entries, effective access, share versus NTFS. Having done it once by hand, you can do it quickly any time.

CHAPTER SUMMARY

  • NTFS permissions form an ACL of ACEs on every file and folder: Full control, Modify, Read & execute, List folder contents, Read, Write, plus 13 special rights.
  • Share permissions (Read, Change, Full Control) apply only over the network; with NTFS, the more restrictive result wins. C$ and ADMIN$ are default hidden shares.
  • Inheritance passes rules down; explicit entries are read before inherited ones; disabling inheritance cuts the link (convert first).
  • Effective permission is the union of matching Allows, with Deny taking rights away; the Effective Access tab calculates it.
  • Ownership lets the owner always change the ACL; takeown and icacls /setowner take it, but never on system files.
  • Special accounts: Administrators, SYSTEM, LOCAL SERVICE, NETWORK SERVICE, TrustedInstaller, and groups such as Users, Authenticated Users and Everyone.
  • UAC keeps full power locked behind a prompt using a split token and integrity levels; it reduces risk but is not a full wall.
  • Administrators are blocked from core files because TrustedInstaller owns them and the ACL gives Administrators only Read & execute.