Welcome to the ITFreeTraining video on how share and NTFS permissions work when used
together. By the end of this video you will understand how both can be used together to
secure your network.
With share permissions, you have 3 to choose from. These are full control, change and read.
The change permission essentially allows read, write, execute and delete to be performed.
With NTFS you have 5 basic permissions. Full control translates to full control. Read translates
to read. Change is equivalent to modify in NTFS. If you combine the two together, all
you need to remember is that the most restrictive wins. Let’s consider some examples.
In this example, the share permissions are set to read. The NTFS permissions are set
to full control. When a user accesses a file on the share they will be given the read permission.
This is because the most restrictive permission wins, which was read in this case. Let’s
consider a different example.
If the permissions were reversed so the share had full control and the NTFS permission were
set to read, notice the result is that the user will still be given read access only.
The most restrictive permissions was read in this case, so that is all the user will
get.
If I were to alter the share permission to Change and replace the NTFS permission with
full control, notice the user will be given modify access which is equivalent to change
access. So in this case change access was the most restrictive so the user ends up with
modify access. This essentially gives the user the ability to read, write, execute and
delete files. For the average user, this should be more than enough.
So the question is, do you configure security at the share level, the NTFS level or both?
If you have a simple file structure or are using a file system like FAT32 which does
not support security, configuring permissions at the share level is a good choice. So, in
this case, using share permissions is a good idea.
If you have a more complicated file structure, an administrator may use full control on the
share and modify on NTFS. The results are effectively the same. Even though full control
has been used, the administrator can subtract access as required at the NTFS level.
Personally if it were me, I would configure the security on the share and NTFS when possible.
This gives you the best security, but is not always practical, depending on what you are
trying to achieve. NTFS allows granularly control of permissions while share permissions
is more of a broad solution.
If I were to open Windows Explorer, you will see that I have created two folders called
DepData and DepData2. We will use these to demonstrate the two different approaches.
If I open the properties for the first folder, I will next select the sharing tab. To see
the permissions that have been configured on the share, I will press the button “Advanced
Sharing” and then press the button “permissions”. You will notice that the permissions have
been set to full control. So, essentially, any user that connects to this share will
have full permissions to everything, assuming the NTFS permissions assigned to that file
or folder allow it.
If I now exit out of here and then select the security tab, you can see the system user
and administrators have full control. If I select the user’s permission, notice that
this has been configured with modify access. You can see that share access is allowing
everyone access and the NTFS permissions are determining what kind of access they have.
If I now exit out of here and open the properties for the folder DepData2, I will once again
select the sharing tab and press the button advanced sharing. I will now press the button
permissions to view the share permissions.
You can see at the top that the Everyone permission has been configured with change access. If
I select the administrator’s permissions, notice that this has been configured with
full control. So, you can see that the permission list is a little more complicated having two
entries. If you have a lot of groups that need access, you can understand why an administrator
may choose to allow everyone access rather than adding each group in here. In some cases
it is simpler to do some basic subtracting of permissions here and use NTFS for more
granular control. Some administrators will use everyone with full control here, but you
can see, even with just two entries, this will increase the security of the share. If
I close these Windows and then go to the security tab, you can see that the entries for system
and administrators have been configured with full control, as you may expect.
If I select users, notice that this has been configured with full control. If this was
done by mistake, this is not a problem because the Everyone permission is configured in the
share permission to change access. This will prevent the user from having more access than
required. You could also remove access on folders if you wanted to. For example, if
you want to give the user read only access to a particular sub folder, you would only
need to remove the write permission for users to that sub folder, giving granular control.
To summarize what was covered in this video: When combining share and NTFS permissions,
the most restrictive permission wins. When you combine the two, using only share permissions
is good for small or simple share folders. They are also useful for systems that do not
support security for example when using the Fat32 file system.
In contrast, NTFS permissions only are good for shares with well setup NTFS permissions.
In this case it is possible to share the folder giving everyone full control. Personally,
I like to remove full control, except for administrators, to provide extra security,
but that is up to the administrator.
Well, I would like to thank you for watching this video and I hope to see you in other
videos from us. Until next time, thanks for watching.