Skip to main content

Understanding NTFS and Share permissions

Recently, I instructed a Microsoft Class (6292: Installing and Configuring Windows 7 Client).  During a presentation about the effective permissions of a user when considering NTFS and Share permissions, one student sat up and said "I finally understand that concept.  Nobody has been able to explain that to me before."

I decided to put a little bit of that presentation here for everyone's benefit.

We use the security model of Microsoft NTFS format to determine what a user is able to do with a file or folder.  We have several different permissions to choose from:

  • Full Control: Users can do anything to the resource.
  • Modify: Users can modify the files and their properties.  Users cannot take ownership or change permissions.
  • Read & Execute: Users can run executable files and scripts.
  • List Folder Contents: Users can view a list of a folder’s contents.
  • Write: Users can write to a file.
  • Read: Users can view files and the files properties.
  • Deny: Absolutely no access.
NTFS permissions need to be taken into consideration when a user accesses a file or folder either locally, or remotely.

Share permissions come into the equation when a file or folder is being accessed remotely through a share.  Share permissions include:
  • Full Control: Allows all Read and Change permissions.
  • Change: Allows all Read permissions plus:
    • Adding files and subfolders
    • Changing data in files
    • Deleting subfolders and files
  • Read: Viewing the contents of folders, data, and running programs.
If a user is a member of multiple security groups. those groups may grant the user multiple levels of permissions.  When just looking at NTFS or Share permissions alone, the users effective permission is the least restrictive one.  For example, if a user is a member of Group A with NTFS Read permission and Group B With NTFS Modify permission, the effective permission is Modify.  Even though the user is a member of a group with lesser privileges, the user is also a member of a group with greater privileges, Windows uses the higher level of permissions.

When you combine NTFS and Share permissions, there is a simple formula to follow to determines a users effective permissions while accessing a resource remotely.
1. Discover the lest restrictive NTFS permission when looking at the user’s security groups, and/or the user account, that has access rights assigned to the resource.
2. Discover the least restrictive share permissions for that user and all the security groups that users is assigned to that have a share permission assigned to it.
3. Now, take the most restrictive of the NTFS and Share permissions.  That is the users effective permission.
In the below example, the user is a member of Group A and Group B.  Group A has the NTFS permission of Modify and the share permission of Change.  Group B has the NTFS permission of  Full Control and share permission of Read.
Group NTFS Share
Group A Full Control Full Control
Group B Modify Change
Write Read
Read Deny
Deny

We first determine the least restrictive permission for NTFS and the least restrictive permission for share.

Group NTFS Share
Group A Full Control Full Control
Group B Modify Change
Write Read
Read Deny
Deny

We can see that for NTFS, our effective permission is Full Control.  For the share permissions, our effective permission is Change.  Now, we need to take the most restrictive of those two permissions to determine the effective permission for this user when accessing the resource remotely.  In this case, the effective permission is Change.

Remember that the share permissions are only considered when the resource is being accessed from another client.  If the resource is being accessed on the same client as the one the user is logged into, we only take the NTFS permissions into consideration.

Comments

Popular posts from this blog

Adding a Comment to a GPO with PowerShell

As I'm writing this article, I'm also writing a customization for a PowerShell course I'm teaching next week in Phoenix.  This customization deals with Group Policy and PowerShell.  For those of you who attend my classes may already know this, but I sit their and try to ask the questions to myself that others may ask as I present the material.  I finished up my customization a few hours ago and then I realized that I did not add in how to put a comment on a GPO.  This is a feature that many Group Policy Administrators may not be aware of. This past summer I attended a presentation at TechEd on Group Policy.  One organization in the crowd had over 5,000 Group Policies.  In an environment like that, the comment section can be priceless.  I always like to write in the comment section why I created the policy so I know its purpose next week after I've completed 50 other tasks and can't remember what I did 5 minutes ago. In the Group Policy module for PowerShell V3, th

Return duplicate values from a collection with PowerShell

If you have a collection of objects and you want to remove any duplicate items, it is fairly simple. # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   # Remove the duplicate values. $Set1 | Select-Object -Unique 1 2 3 4 5 6 7 What if you want only the duplicate values and nothing else? # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   #Create a second collection with duplicate values removed. $Set2 = $Set1 | Select-Object -Unique   # Return only the duplicate values. ( Compare-Object -ReferenceObject $Set2 -DifferenceObject $Set1 ) . InputObject | Select-Object – Unique 1 2 This works with objects as well as numbers.  The first command creates a collection with 2 duplicates of both 1 and 2.   The second command creates another collection with the duplicates filtered out.  The Compare-Object cmdlet will first find items that are diffe

How to list all the AD LDS instances on a server

AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.