Understanding NTFS and Share permissions

Recently, I instructed a Microsoft Class (6292: Installing and Configuring Windows 7 Client).  During a presentation about the effective permissions of a user when considering NTFS and Share permissions, one student sat up and said "I finally understand that concept.  Nobody has been able to explain that to me before."

I decided to put a little bit of that presentation here for everyone's benefit.

We use the security model of Microsoft NTFS format to determine what a user is able to do with a file or folder.  We have several different permissions to choose from:

• Full Control: Users can do anything to the resource.
• Modify: Users can modify the files and their properties.  Users cannot take ownership or change permissions.
• Read & Execute: Users can run executable files and scripts.
• List Folder Contents: Users can view a list of a folder’s contents.
• Write: Users can write to a file.
• Read: Users can view files and the files properties.
• Deny: Absolutely no access.

NTFS permissions need to be taken into consideration when a user accesses a file or folder either locally, or remotely.

Share permissions come into the equation when a file or folder is being accessed remotely through a share.  Share permissions include:

• Full Control: Allows all Read and Change permissions.
• Change: Allows all Read permissions plus:
• Adding files and subfolders
• Changing data in files
• Deleting subfolders and files
• Read: Viewing the contents of folders, data, and running programs.

If a user is a member of multiple security groups. those groups may grant the user multiple levels of permissions.  When just looking at NTFS or Share permissions alone, the users effective permission is the least restrictive one.  For example, if a user is a member of Group A with NTFS Read permission and Group B With NTFS Modify permission, the effective permission is Modify.  Even though the user is a member of a group with lesser privileges, the user is also a member of a group with greater privileges, Windows uses the higher level of permissions.

When you combine NTFS and Share permissions, there is a simple formula to follow to determines a users effective permissions while accessing a resource remotely.
1. Discover the lest restrictive NTFS permission when looking at the user’s security groups, and/or the user account, that has access rights assigned to the resource.
2. Discover the least restrictive share permissions for that user and all the security groups that users is assigned to that have a share permission assigned to it.
3. Now, take the most restrictive of the NTFS and Share permissions.  That is the users effective permission.
In the below example, the user is a member of Group A and Group B.  Group A has the NTFS permission of Modify and the share permission of Change.  Group B has the NTFS permission of  Full Control and share permission of Read.

Group	NTFS	Share
Group A	Full Control	Full Control
Group B	Modify	Change
	Write	Read
	Read	Deny
	Deny

We first determine the least restrictive permission for NTFS and the least restrictive permission for share.

Group	NTFS	Share
Group A	Full Control	Full Control
Group B	Modify	Change
	Write	Read
	Read	Deny
	Deny

We can see that for NTFS, our effective permission is Full Control.  For the share permissions, our effective permission is Change.  Now, we need to take the most restrictive of those two permissions to determine the effective permission for this user when accessing the resource remotely.  In this case, the effective permission is Change.

Remember that the share permissions are only considered when the resource is being accessed from another client.  If the resource is being accessed on the same client as the one the user is logged into, we only take the NTFS permissions into consideration.