Welcome to ITFreeTraining video on the deny permission. The deny permission effectively
prevents access. Using the deny permission can be useful in certain circumstances; however,
there are also pitfalls to this command that the administrator should be aware of.
The deny permission overrules all other permissions, well, most of the time. Let’s have a look
at how it works.
If you consider that you have a user called Joe, in this case there are explicit permissions
configured. The first permission denies Joe from access. The second permission allows
everyone to have access. When permissions are configured on a file or folder, the deny
permissions will always be sorted to the top of the list. So when Windows checks the permission
list from top to bottom, it first sees that Joe has been denied and it will deny Joe access.
What is interesting is what happens when explicit permissions and inherited permissions are
combined together. If you take the user Joe again, this time the permissions have been
configured allowing Joe access. The next set of permissions is inherited and denies everyone
from having access. Even through there is a deny permission, Joe will be still granted
access. Although this may seem strange, there is a good reason why this occurs.
To understand why, consider this. Denys are always sorted in the list to be at the top.
However, there are two lists of permissions, the explicit and inherited. Explicit is checked
first. Once this has been checked the inherited permissions are checked. Even though the denies
are checked first, if there is a match with the explicit permissions, the inherited permissions
are not checked. So in this example Joe will be denied access and everyone else will be
allowed access. Even though Domain Users have been denied, this is in the inherited permissions
list which will never be checked because all users will be allowed access through the everyone
permission.
To demonstrate this a bit better, I will open Windows Explorer. I will next right click
on the folder ‘Joe’ and select the option ‘properties’ and then select the security
tab. To change the permissions, I will right click on the edit button and then press the
button ‘add’. In this case I will add everyone to the list of permissions.
Once everyone has been added to the permissions list, notice by default everyone has been
allowed read and execute permissions. Notice beside these are the tick boxes for the deny
permission. In this case I will clear all the allow permissions and then tick the deny
permission for write. This will effectively prevent all users from writing to the folder.
Notice that when I press apply, a dialog message is displayed stating that deny permissions
will overwrite other permissions. This is particularly important if a user is a member
of two groups. For example, if a user is a member of the sales group and also the marketing
group. If either of these two groups is denied access, that user will not be given access.
If I now exit out of here and go back to Windows Explorer, notice that if I now go into the
folder and then attempt to create a new folder, I will be given an access denied message.
If I cancel this message and then go into the sub folder Docs, notice that if I attempt
to create a folder in the sub folder, I once again will get an access denied message.
Let’s cancel this message and go back to the sub folder. I will then open the properties
for the folder and select the security tab. In the permission list, notice that everyone
is present and at the bottom the permission for write is grayed out.
I will now press edit, and then press add. In this case, I will enter in the group Domain
Users. Once Domain Users has been added, I will clear all the permissions and tick allow
write. If I press o.k. and go back to the properties, notice that if I select everyone,
the write permission is set to deny and the tick is gray because the permission is inherited.
If I select domain users notice the write permission is set to allow and is black because
it has been explicitly set.
If now exit out, notice that I can now create a sub folder in the Docs folder. Effectively,
even though there is a deny permission in the permission list, since this is inherited
the explicit permission configured to allow has allowed access.
A lot of administrators consider the use of the deny permission to be a last resort and
it should be only used when necessary. This is one example when it can have unexpected
results. Also, it should be remembered that if the user is a member of two groups, this
can cause problems as well. For example, if you deny access to the Domain Users group,
the Domain Administrators account is often a member of the domain users group. So in
effect you have also denied access to the Domain Administrators - Something to keep
in mind when configuring deny permissions.
If I now open the properties for the sub folder and select the security tab, once again I
will press edit to edit the permissions. Notice that the everyone permission is set to deny
write and is gray, indicating that it has been inherited. I am not able to clear this
tick box, but notice that I can tick the allow tick boxes. So effectively, you can add to
inherited permissions, but cannot change them. Notice that if I want to, I could also tick
additional deny tick boxes.
If I select the domain user’s entry, notice that I can also tick additional tick boxes.
Keep this in mind, as it allows you to make some changes to inherited permissions rather
than disabling inheritance or making changes to the inheritance hierarchy. You can see
that after the permissions have been configured, you are still able to make changes in the
way of adding; however you need to disable inheritance if you want to subtract permissions.
The deny permission does allow you to retract a permission after it has been assigned, however
there can be problems with it.
If you start using the deny permission you should consider the effect that it will have
when the user is a member of multiple groups. Let’s consider the following example, our
user Joe is a member of two groups, the sales and marking groups. If you have a file share
and you deny members of the sales group access and allow marketing group access you could
do the following. You could configure the permissions for the sales group to deny and
the marketing group to allow. The problem with this approach is that since Joe is a
member of both groups, he will now be denied access.
This normally would not be the required result. So how do you deny access to the sales group
but still allow access to users that are members of both groups? The answer is quite simple,
you remove the sales group from the permission list. Now only the Marketing Group will be
given access. Users that are a member of only the sales group will be denied access. Users
like Joe that are a member of both groups will be allowed access. You can see that in
many cases, the result that you are trying to achieve can be achieved without using the
deny permission. This is one of the reasons many administrators try not to use the deny
permission, but sometimes it is unavoidable.
That’s it for the deny permission. I hope you have found this video informative and
I hope to see you in other videos from us. Thanks for watching and see you next time.