In this video from ITFreeTraining, I will look at basic NTFS permissions. Basic NTFS
permissions are used in Windows to control who has access to files and folders. It forms
the foundation of security in Windows and determines if a user is allowed or denied
access.
Shown here are the basic permissions that can be assigned to files and folders. In most
cases, these basic permissions will be all the administrator needs. Later in the course,
I will look at how these permissions can further be customized, when I look at advanced permissions.
Each of the six basic permissions listed here have different effects depending on if they
are applied at the folder or file level.
The first permission is “List Folder Contents”. This essentially does just as the name suggests,
it lists all the files and folders in that folder.
To understand how this permission works, I will open Windows Explorer and have a look
at what happens when the permission is applied. In this folder I have created a folder called
NTFS Demo. If I attempt to open this folder notice that I get an error message saying
I do not have access to this folder. This is because I have removed all the permissions
from the folder. In order to configure some permissions, I will close this window, right
click the folder and select the option properties.
Once the properties have opened, I will select the security tab. You can see, at the top
of the screen, no users or groups have been added to the permissions for this folder.
To add some, I will press the edit button. Next I will press the add button to add a
user or group. In this case, I will enter in “everyone” which is what is referred
to as a special identity. Special identities have special properties. As the name suggests,
in this case, the special identity everyone refers to all users.
Once I press OK I will be taken back to edit permissions. At the bottom of the screen,
you can see the basic permissions. If you want to enable a particular basic permission,
it is just a matter of ticking “allow” for the required basic permission. To start
with, I will first clear all the allow tick boxes that were ticked by default. Now I am
back to where I started with, no permissions are configured on this folder.
To start with, I will tick allow for “List Folder contents”. Once ticked I will press
apply to commit the change. If I now go back to Windows Explorer, notice that I can now
open the folder “NTFS Demo”, which I could not do before. Now that the folder has been
opened, I can see all the files and folders in that folder.
I have two files in this folder. The first file is an application called “BadApp”.
This is a free application that you can download from the internet free of charge which is
good for demonstrating poor application behavior like crashes. If I double click the application
to run it, notice that I get an error message saying that I do not have access to the file.
Even though I have enough access to see that the file exists, I do not have enough access
to execute the application.
If I go back to Windows Explorer there is also a document that I have placed in the
folder. If I attempt to open this document I will also get an error message stating access
was denied. If I close this error message, in the folder, I also have a sub folder. If
I open this folder, this contains the same files as the previous folder. If I attempt
to open the document and run the application, like before, I will be denied access to open
the document and run the application.
You can see how the permission “List Folder Contents” works, it allows files and sub
folders to be seen but does not allow reading of the files or execution of applications.
I will now go back to Windows Explorer and go back to the parent folder and have a look
at the next basic permission.
The next permission that I will look at is the read permission. The read permission,
as the name suggests, allows a file to be read, however it does not allow execution
of an application. I will now go back to Windows Explorer and have a look at how the read permission
works.
If I select the permissions for the NTFS demo folder, I will clear the permission “List
Folder contents” and then tick the permission for read. Notice that once I apply the permission
and go back to the folder and attempt to Run BadApp, I will get an error message. I am
able to see executables; however, I am not able to run them. If I attempt to open the
document, this will be allowed. The read permission essentially gives you access to read data
files but not run executables. This covers the read permission.
If I now go back and look at the next permission, this is the read and execute permission. This
does as it suggests. It allows files to be read and also allows execution of files. If
I now go back to Windows Explorer, I will go back to the permissions for the folder
and remove the read permission that I set earlier. Look at what happens when I tick
the permission “Read & execute”. When ticked, notice that the permissions “list
folder contents” and “Read” are ticked as well. If I were to clear the tick box for
read permissions, notice that the “Read & Execute” permission is clear. When you select “Read
& execute” it requires the other two permissions to be on, as well.
If I now tick “Read & execute” and apply the permissions and then go back to the folder,
I can now run BadApp without any problems. I can also open the document without any problems.
So you see this permission allows reading and executing of applications. However, notice
that if I go back to Windows Explorer and attempt to create a folder, I am denied access
to do this. So far, only read related permissions have been looked at. The next permission that
I will look at is the write permission.
The write permission gives the user the ability to write to existing files and also create
new files and folders. The write permission is independent of the others, so it does not
give the user read permission to the file. Let’s have a look at how it works.
If I now go back to the permissions for this folder, I will clear all the existing permissions
that have been configured and then tick the tick box for write, so only the write permission
has been set. If I now go back to Windows Explorer notice that all the files appear
to have gone. Without any read permissions configured, I cannot see what is in the folder.
If I now right click and select the option new and then select “Text Document”, notice
that this appears to work, however no file can be seen. If I go back to the permissions
and add the read permission, notice that, once applied, I can go back to the folder
and see the file that I just created.
It would seem that I have created a folder that I can write files to but cannot see them.
However, using only the write permission can cause some problems. If I now open the text
document I just created, I will add some text to it. Once this is done I will go back to
the permission and remove the read permission so the only permissions being applied are
the write permission.
Notice what happens if I go back to notepad and attempt to save the file. Notepad prompts
for a filename to save the file to. If I attempt to browse to the folder where the file is
stored, notice that I get an error message indicating that I cannot access the folder.
If I cancel this message and attempt to enter in the full name and path, the operation will
fail with an error message indicating the user does not have enough access. If I cancel
out of here and back to the permissions, I will add the read permission, apply it and
then go back to Windows Explorer.
Notice that a file called test was created; however, when I open it, there is no data
in the file. So the file started to save but was not successful in writing any data to
it. Notice also that if I attempt to delete the file, I will also get a permission denied
error. This should start to show how important it is to test permissions with the applications
that you are using. For example, Microsoft Word will write data to a temporary file rather
than the actual file. When the file is saved this causes files to be deleted and then recreated.
This means read and write will not be enough if you are using Microsoft Word to create
and update documents. However, if you are using software like Notepad, read and write
is enough to create and update documents.
The next permission that I will look at is the modify permission. This is the permission
that administrators will generally give end users. This gives the user enough access to
read, write, execute and delete. If I go back to Windows Explorer, I will have a look at
the modify permission.
If I go into the permissions, I will first un-tick all the permissions that are currently
set. Once these have all been cleared, I will tick the permission “Modify”. Notice that
when I tick the “Modify” permission all the permissions below are also ticked.
So essentially, Windows is telling you that modifying permissions grants all other permissions.
If I apply the permissions and then go back to Windows Explorer, notice that I can run
BadApp and I can also open the document in Word Pad. If I make a change to the document
I can save the document and reopen it and the change will have been recorded. Notice
the two documents that I created earlier I can now delete. It would seem like you have
all the access you would ever need. However, there is still one more access permission
to cover.
The last permission is full control. This permission includes all the other access and
some additional permissions. These additional permissions are the ability to change permissions
and take ownership. Change permissions, as the name suggests, change the permissions
assigned to a file or folder. Some of you may be thinking that I have been doing that
for the whole video without that permission so how is this possible? If you are the owner
of a file, you are able to change the permissions of a file or folder without having this permission
being assigned to you. For example, it allows the owner of the file the ability to make
it read only but then gives themselves the ability to add write access later on. Without
this, the owner would have to always leave the permissions set to full control otherwise
they would never be able to change the permissions without locking themselves out of the file
or folder.
Full control also allows the owner of the file or folder to be changed. For example,
some files were copied from one user to another user. This would be a good example of when
you may want to change the owner of a file or folder. I will now go back to Windows Explorer
and have a closer look at how full control works.
If I go into the permissions for the folder, I will first clear all the permissions that
have currently been set. If I now go back to the top and select “Full control” notice
that all the permissions below it are ticked. Essentially, full control gives you access
to everything plus the ability to change permissions and take ownership of the object. Currently,
the user logged in is the owner of the folder. For this reason, I have been able to change
the permissions of the folder so far without having full control. To demonstrate a bit
better how this works, I will remove all the access from the file, essentially meaning
no permissions have been assigned to the file.
Notice that when I press apply, I get a message indicating that if I do this, no one will
be able to access the folder and only the owner will be able to change the permissions.
I will press yes to continue, effectively removing all permissions from the file.
If I now exit out of here and go back to the properties for the folder, I will next press
the advanced button. The advanced setting allows me to view the current owner of the
folder. You can see at the top that the owner of the folder is administrators. This is how
I have been able to change the permissions of the folder even though I did not have the
full control permission. To show this better, I will press the change button and then change
the owner of the folder to the system user. Once I press OK I have effectively locked
the administrator out of the folder, preventing them from accessing it or changing permissions.
If I now exit out of here and go back to the folder properties and press the edit button,
notice that I get an error message saying that I donot have access to view the permissions,
but I can make changes. However, when I press OK and attempt to add everyone to permissions,
I am able to add everyone to the list of permissions. However, when I press OK to commit the change,
notice that I get an error message telling me that access was denied. So it seems like
I am stuck and will not be able to get access to the folder anymore, but there is a way
around this.
If I now go back to the properties of the file and press the advanced button, notice
at the top of the screen, since I have no access at all, that the owner of the file
cannot be displayed.
When this occurs there is a back door in order to get access again. Any user that is an administrator
has an additional right assigned to them. This right allows them to change the owner
of a file or folder even without having any access. Since I am logged in as an administrator,
if I now press “Change” I will be able to change the owner of the folder. For the
owner I will enter in administrators, which is a built-in group that contains all the
local and domain administrators. Once I press OK and then press OK again I will be taken
back to the properties of the folder and can see that the owner of the folder has been
changed to the local administrators group.
If I now press edit and then press add, I can now enter in “everyone” and, like
before, it will be added to the permissions list, but notice this time when I press apply,
the permissions will be changed. Even though I do not have access to the folder, since
the administrators group is the owner of the folder, I can change permissions on the folder.
That covers it for the basic permissions for the folder level. In later videos I will be
going into more detail about how NTFS permissions work. There was a lot covered in this video,
so I will perform a quick summary of the major points.
One of the most commonly used permissions for users is modify. This gives the user the
ability to read, write and delete files. Your average user should not require any more access
then this.
The full control permissions gives all the standard permissions plus the ability to change
permissions and the owner. The owner of the file, by default, has the right to change
permissions regardless of what permissions are already assigned.
If all else fails and access is lost, an administrator can change the owner. This is regardless of
the permissions that are configured, for example, if there are no permissions configured at
all. Once the administrator is the owner they are free to change permissions as they see
fit. This creates a back door so to speak if permissions are changed to prevent access.
Well I hope you have enjoyed this video from ITFreeTraining and found it informative. For
more free videos from us please see our YouTube channel or website. Till next time, thanks
for watching.