Welcome to the ITFreeTraining video on advanced NTFS permissions. Previously, I looked at
the 6 basic permissions. Advanced permissions allow the administrator to divide these 6
basic permissions up into smaller parts to give more control to the administrator.
Shown here are the 14 advanced permissions that are available. In older versions of Windows
these were referred to as special permissions. 13 of them are available for files and folders
while one is only available at the folder level. Depending on whether the permission
is applied at the folder or file level will affect what it does. For example, the first
permission, list folder/read data, when used at the folder level will allow the files in
a folder to be seen, but if it is applied to a file it will allow the file to be read.
In most cases, the 6 basic permissions will be enough for the average administrator. In
some cases the administrator may need additional control over permissions. When this is the
case, they may need to configure advanced permissions.
The 6 basic permissions map to 14 advanced permissions. As you can see, when you select
the read permission you are in fact selecting 4 advanced permissions. These are “List
Folder/Read Data”, “Read Attributes”, “Read extended attributes” and “Read
permissions”. If you select the basic permission “list folder contents”, this also selects
all the read permissions and adds “Traverse folder/execute file”. “List Folder contents”
is different than the other basic permissions as it only applies at the folder level and
does not affect files.
If I were to select the basic permission Read & Execute, this would also include all the
permissions above it. If I were to select the basic permission write, note this would
select the 4 basic permissions on the right. You can start to see how basic and advanced
permissions relate to each other.
If I were to select “modify”, notice that all the permissions above it are also selected.
This brings us to the next question, can individual advanced permissions be selected? The answer
is yes, for example I could select the delete permission by itself. Although this is possible,
this would mean that you would not be able to see what is in the folder to delete. For
this reason, if you wanted to give the user only the ability to delete files, you would
probably give them the “List folder/Read Data” advanced permission as well. This
would give the user the ability to see the files in Windows Explorer so they can delete
them. I will now look at an example of how to use advanced permissions.
In this example, I will configure a folder to allow the user to read, write and execute
applications. However, they cannot delete any files.
To do this, I will open Windows Explorer and then create a new folder which I will call
Docs. If I now right click Docs I will select properties and then, from properties, I will
select the tab security.
The permissions that are listed here have been inherited from the parent folder, so
I will first remove these. To do this I press the advanced button and then press the button
“Disable inheritance”. Windows will then ask if the existing permissions are going
to be kept or removed. In this case, I will select the second option and have the existing
permissions removed.
In the real world you would most likely leave the administrators and system user in the
permission list and given them full control. In this case, I will only use the administrators
group. Since the administrators group is the owner and I am logged in as an administrator,
I can change the permissions of the file at any time even if I do not have access.
You will notice that, with the way the permissions were set up, even though I removed the permissions,
there is still one entry left for administrators. With that permission selected, I will now
press the edit button to make changes to it.
You can see, on the left hand side, all the basic permissions that have been configured.
In most cases the basic permissions will be enough, but for this example they will not
be. To show this, I will tick the permissions for read and write.
If I now select the option of “Show advanced permissions”, this will show the 14 advanced
permissions. You will notice that the delete permission is not ticked, which is what we
want. However, also notice that the option for “Traverse folder/execute file” has
not been ticked. This means that executables in the folder will not be able to be run which
is not what we want in this case.
If I now select the option for “Show basic permission” this will change the view to
show the 6 basic permissions. In this case, I will tick the tickbox “modify”. If I
now select the option “Show advanced permissions” notice that this time the option for “Traverse
folder/execute file” is enabled which will allow executables to be run. This is what
we want, however notice that delete has also been ticked which is not what is required.
So, essentially, using basic permissions will not give the desired result of allowing read,
write and execute but disabling the ability for files to be deleted.
You can see that using basic permissions has not given the required results. In order to
achieve the required result, I will clear the permissions delete. If I now press o.k
I will be taken back to the list of permissions.
Notice at the top, the option permissions is configured to apply to “This folder only”.
This permission will currently only effect the folder, not the files in the folder or
sub folders. I cannot change this in the interface so the only way around this is to press the
add button to add more permissions.
First, I need to select the option at the top “Select a principal” and then enter
in administrators. This will determine which user or group the permissions will be created
for. In this case, permissions will be created for the administrators group.
I will next select the basic permissions “modify” and then, from advanced permissions, deselect
the delete permissions like I did previously.
Notice below the permissions there is a tick box “Only apply these permissions to objects
and/or containers within this container”. If this tick box is ticked then these permissions
will only apply to this folder and objects in that folder.
If I now press o.k. and go back to the previous screen, notice that there is still only one
entry; however, the “applies to” option has changed from “folder only” to “this
folder, subfolders and files”. You will notice this when you add or remove permissions,
sometimes extra lines will be added and other times they will be removed. Windows will display
the list the best way it can based on the permissions that have been set.
If I now exit out of here and go to Windows Explorer, I have the Windows Help file executable
that I will now move into the Docs folder and I will run it. Note that it will run without
a problem.
If I close Windows help, notice that I can create a text document in the Docs folder.
I can also open the file and edit it. Once the changes are made I can close the file
and save the changes. Notice however that if I select the file and attempt to delete
it, I get an error message saying access has been denied. So the permissions have worked.
They have allowed read, write and execute; however, deletes have been prevented from
occurring.
If you attempt this kind of setup in your company, test it with the applications that
you want to use it with. Software like Microsoft Office will often require the delete permission
when saving files. This is because it uses temporary files in the saving process.
Before finishing this video, I will have a quick look at each of the advanced permissions.
This will help you to decide if or how you want to use them.
The first permission is “list folder/read data”. If you assign this permission to
a folder this allows the user to see a listing of files and sub folders in that folder. If
the permission is assigned to a file, it gives the user the ability to read the file.
The next permission is “read attributes”. This allows the user to read attributes of
the file. As shown here, the basic attributes are found in the general tab. These include
read-only and hidden. If you do not have the view attribute permission, the details of
this tab will not be available.
The next permission is “read extended attributes”. Extended attributes allow applications to
add their own attributes to a file. In Windows this is pretty rare and a feature generally
used in alternative operating systems.
The next permission, “read permissions” allows the user to read the permissions of
a file or folder. If you open the properties of a file, this is essentially the security
tab. This permission essentially allows a user to read what permissions are assigned
to a file or folder, but they are not able to make changes.
The next permission is “traverse folder/execute file”. This allows a user to move between
folders and, when applied to a file, allows them to execute a file. To demonstrate this
one a bit better, I will open Windows Explorer. If now open the Docs folder I will create
a folder and called it SubFolder. Next I will move the Windows Help executable into this
folder. If I now open the properties of the Docs folder I will select the security tab
and then press the advanced button. The only permission listed is for administrators, I
will select this and then press edit. I will next press “show advanced permissions”
and then press the button “clear all” and tick the permission “Traverse folder/execute
file” making it the only permission that is configured. I will now exit out of here
and go back to Windows Explorer. You will notice that if I attempt to open the Docs
folder I will get an error message telling me access denied, so there appears to be no
way to run the Windows executable. However, notice that if I enter in the path manually
I can run the executable. So the traverse folder permission allows the user to pass
through folders to access files and documents. However, it does not give them the ability
to read or even see what files are in that folder. If the execute file permission is
applied, this permission gives the user the ability to run executables.
The next permission is “create files/write data”. This permission gives the user the
ability to create files and if applied to a file gives them the ability to write to
the file.
The next permission is “Create folders/Append data”. At the folder level it allows sub
folders to be created under that folder. The “append data to a file” permission is
an interesting one. It allows data to be written to the end of the file, but does not allow
data to be rewritten in the file. This would be a good permission to use for a log file
as you do not want to overwrite what is there already, only add to the file. The problem
with this permission is that the software that is writing to the file needs to open
the file in append mode. If the software does a standard open command on the file, the file
will not be able to be append to it unless the write permission is included as well.
For this reason, if you plan to remove the write permission and use only the append data
permission, you would need to test your software to ensure that it will work correctly with
this permission.
The next permission is “write attributes”. This essentially allows the user to make changes
to the attributes found on the general tab. For example, changing the file to hidden.
The next permission is “write extended attributes”. This allows applications to create their own
custom attributes and write them to a file or folder. This is mostly used in 3rd party
operating systems and is not used in Windows very often.
The next permission is “delete”. This simply allows the user to delete files or
folders.
The next permission, delete subfolders, can only be applied to folders. It allows the
user to delete files and folders in the folder. If this permission is configured, the user
is able to delete files in the folder even if the delete permission has not been configured
on that file.
The next permission is “change permissions”, this essentially allows the user to change
permissions shown on the security tab. Having this permission essentially means the user
could change the permissions, giving themselves all the other permissions if they want to,
but it is what it is.
The next permission is “change ownership”. This allows the user to change the owner of
a file or folder. As shown here, at the top, the owner is listed as the Administrators
Group. The owner of the file has the ability to change permissions even when they do not
have access to the file or folder. It is a back door in Windows to prevent a user from
removing access to one of their files or folders by mistake. So essentially if a user has this
permission, they can change the owner to themselves and then change the permissions on the file
or folder.
The last permission is “full control”. This permission gives the user access to all
the other permissions. You can see that you can get come interesting results from using
advanced permissions. However, in most cases the administrator will be able to achieve
what they want using standard permissions.
Thanks for watching this video from ITfreeTraining. I hope to see you in other videos from us.
Until then, thanks for watching and I hope to see you in the next video.