Welcome to the ITFreeTraining video on NTFS Explicit and Inherited permissions. By the
end of this video, you will understand how to assign permissions directly and how to
take advantage of inheritance, making it easier for the administrator to manage access to
files and folders on their network.
Explicit permissions are set when the object is first created, or set by user action. Inherited
permissions are permissions a child object obtains from a parent. For example a file
may obtain permissions from its parent folder or a sub folder may obtain permissions from
its parent folder. Let’s consider a typical real world scenario to get a better understanding
of how this works.
If you consider the root folder of the c drive, the folder has some permissions that have
already been assigned to it. In this case, they are explicit permissions, since they
are assigned directly to the folder. In this case they give everyone read & execute permission
and full control to administrators.
The administrator wants to create a folder to hold user documents. Each user will have
their own folder that they can store documents in. Also, the other users will be able to
read the documents in other users’ folders. The next step is to create a folder called
Users on the c drive. The folder will inherit the permissions of the c folder.
The next step is to create folders for each user. The first folder I will create is for
the user Joe. Like all the users’ folders, this folder will inherit the permissions of
the parent folder. This will give all users the ability to read the folder; however, will
not give the user Joe the ability to write to the folder. In order to allow this to occur,
an explicit permission will be added to the folder giving the user Joe Modify access.
This will allow Joe to write to the folder, however all others users will only be able
to read files.
If the user Joe was to create a sub folder called Docs, notice that when this folder
is created, it will inherit the permissions for the previous folder. You can start to
see how explicit permissions and inherited permissions can be used together.
To have a look at how you would achieve something like this in Windows, I now open Windows Explorer
and open the d drive and create a new folder and call it users. If I now right click the
folder and open the properties, I can then select the security tab to see the security
that has been applied to this folder.
There are 4 permissions that have been applied. In particular, notice administrators and users.
If I cancel out of here and open the Users folder, I will create a folder called Joe.
This folder needs to be able to be read by all users, however Joe is the only one that
should be able to write to it.
To achieve this, I will right click on the folder and select properties and then select
the security tab. From the security tab, I will press the edit button. Next, I need to
press the add button. Next, I need to enter in the username that I want to add, in this
case the username that I will enter in is Joe.
Once Joe has been added, I next need to tick the Modify permissions, as by default Joe
will only have read access. Once permissions have been configured, I can exit out here,
open the Joe Folder and create a new folder called Docs.
If I now open the properties for the Docs folder and then select the security tab, notice
that the username and the other permissions have been inherited from the parent folder.
Also notice that the user’s permission have been inherited. So this means that all users
have read access, but maybe that was a mistake and later on it was decided that users should
not be able to access each other’s folders.
To change the permissions, I will once again open the properties for the Joe folder and
select the security tab. If I select Joe, notice that, under permissions, the permissions
ticks are black. This indicates that the permissions have been explicitly set.
If I select the user’s permissions, notice that these permissions are gray, indicating
that they have been set through inheritance. Since they are gray, I cannot modify them,
so how do I remove the permission so that the general user cannot access the folder?
To do this, I need to remove the inherited permissions. To do this I need to press the
advanced button. From advanced settings the next step is to press the button “Disable
Inheritance” at the bottom.
Once pressed, I will be given a dialog box asking if I want to copy the existing permissions
or remove all the permissions. In this case I will select the option “Convert inherited
permission into explicit permission on this object”, which effectively copies the inherited
permissions to the folder.
If I now exit out of here, the permissions can now be edited, since they are explicitly
assigned to the folder rather than inherited. You can see, when I select each permission,
the ticks have changed from gray to black.
To remove the user’s permissions, I will press the edit button, select users and then
press the remove button, apply the permission, change and exit out and go back to Windows
Explorer. I will next open the properties for the Docs folder. Once open, I will select
the security tab and you’ll notice that the user John Doe and Administrators have
still been inherited but the users group has been removed. This is indicated by the gray
ticks allowing the administrator to know quite quickly if permissions had been inherited
or explicitly set. You can see how powerful inheriting can be, allowing a large hierarchy
of permissions to be changed quite easily.
Well that covers the basics of explicit and inherited permissions. In a later video I
look at how you have more control over inherited permissions, but until next time, thanks for
watching.