Welcome back to your free training course for the Windows 7 70-680 exam. In this video
I will continue to look more into NTFS permissions covering the advanced features
NTFS can offer. Before I get started, I want to first look
at something not covered in our sharing video and NTFS video. This is how Share and NTFS
permissions work when combined. Put simply, when these permissions are combined
the most restrictive permission wins. Given this example, if the share permissions
are set to full control on the share and the NTFS permissions are set to read, the user
will only ever have read access to the file. The fact that they have full control at the
share level does not give them more rights. This also applies in reverse. If the
share permissions are set to read and the NTFS permission are set to full control,
again the effective permissions for a file or folder would be read. When you are dealing
with NTFS and sharing permission together, simply ask yourself which is the most restrictive
permission and this will tell you what permissions the end user will get.
In the last video I looked at the standard NTFS permissions which gave you 6 basic
permissions you could choose from. If you need more control over your files and folders,
you can assign them advanced permissions often referred to as special permissions. This gives
you 13 permissions to choose from. These 13 permissions map to the 6 basic permissions
covered in the last video. First you have the read permission. When you assign the read
permission to a file or folder you are essential assigning it the following 4 permissions.
The first permission is list folder read data. If applied at the folder level it will allow
you to see the filename of any file or folder regards of the permissions on the file or
folder. If you want to make a submission folder, a folder in which people can drop files but
not see the files that have already been written to the folder, you would clear this permission.
If this permission is applied at the file level this gives the user the ability to read
data in the file. The next permission is the read attributes
permission. This gives the user the ability to read the basic attributes of a file or
folder. This includes the read only, hidden and archive attributes. The next advanced
permission that is set when selecting the basic read permission in read extended attributes.
Extended attributes are set by programs and may vary from program to program.
The last permission set when selecting read is read permissions. This allows the user
to read the NTFS permissions but not make changes. You can see from assigning the basic
read permission in NTFS you are in fact setting 4 of the advanced permissions. In
most cases, assigning the basic permission will work fine, in some rare cases you will
need to configure the permission on a more granular level then setting basic
permissions allows. If I now look at the basic write permission,
this is also assigned to 4 of the advanced permissions. The first is “create files
write data”. On the folder level this gives you the ability to create files in the folder.
If you don’t want to allow creating of new files edit the existing folder permissions
and clear this permission. If you apply this permission to a file, this permission allows
the user to write to the file. The next permission is “create folder append
data”. This permission when applied to the folder level allows the user to create new
sub folders in that directory. When it is applied at the file level it allows the user
to append data to the end of a file but not change any existing data. If you had a log
file that you wanted to ensure was not changed after it was written to, you would select
this permission and clear the write data permission. The next permission is the write attributes
permission. This allows the user to change the basic file attributes on the file such as
read only, hidden and archive. The last permission is write extended attributes which allows
the user to change extended attributes set by programs.
The next of the basic permission is list folder contents. This permission is only available
at the folder level. This permission set the traverse folder permission and the 4 read
premisisons. The traverse folder permission allows a user to go through directories even
if there don’t have access to them. For example, let’s say a user does not have
permissions to a folder. This would also mean that they could not access any folders below
that folder. However by giving them transverse permissions,
they could access any folder under the folder that they have access to. Simply put, they
can access a folder lower in the folder hierarchy is they knew it was there even when they don’t
have access to the folders above. When you select list folder contents, it includes
all the permissions set when you select the basic read or write permission.
The next basic permission is read & execute. When this basic permission is set it applies
all the advanced permissions above it on both the folder and file level and adds the execute
files permission when applied to files. The execute permission allows the user to
run executable files. This does not include scripts and other files that are essentially
run by anther program. Think of it like this, if the file can be opened using the file open
command from anther program or dragged and dropped on a program to open or run it then
it is not an executable file. The next basic NTFS permission is modify.
This includes all the above permissions and adds the delete permission. The delete permission
does just that, it allows you to delete a file or folder. You can probably start guessing
that using the advanced permissions gives you a lot more control over files then using
the basic permissions. Using advanced permissions you could give the user the ability to read
files and delete files but not change files. Something that is not possible using the modify
permissions. The last of the basic permissions is full
control which adds 3 advanced permissions. This first permission adds the ability to
delete extended attributes created by applications. The next permission is change permissions.
This allows the user to change the NTFS permissions that have been assigned.
The last of the advanced permission is the take ownership permission. This allows a user
or users to change the owner of a file or folder. The owner of a file or folder has
the ability to change the NTFS permissions even if they do not have access to the file.
I will now change to my Windows 7 computer to demonstrate advanced NTFS permissions.
First of all I will open Windows explorer and go to the properties of a directory I
created called NTFS advanced permissions. Once in the properties I will go to the security
tab. First of all I will edit the standard permissions to demonstrate a point.
I will change the permissions for users to list folder contents. Now if I go back and
select the button advanced and select the permissions for users, it will show it has
the permissions of list folder contents but also it applies only to this folder and sub
folders. For the files in the directory, it gets it
access for the entry below it. Notice that the permissions in this case are called special.
These are applied to the folder, sub folder and file level. This essential means the files
don’t have execute access. To show this a bit clearer, if I press button
change permissions and then select this entry and press edit, you will notice that “traverse
folder execute file” is not ticked. This entry will make sure that files in this folder
do not have the execute permission. If I were to add this permission back in and
go back to the previous screen, I now only have one entry. That is, read, write and execute.
You will notice that when you edit permissions, if the edit matches a basic permission it
will be displayed as that basic permission. If Windows can’t not match the permissions
to a basic permission the entry will be listed as special.
If I go back in and edit the permissions, notice that I can apply this permission to
a number of different places. Firstly the folder level and then every combination of
folders, sub folders and files down to files by themselves. This gives you a lot of control.
For example, you could create a folder where users could only access files in that folder
but could not access any data in any of the sub folders.
You may be thinking I could just create these folders myself and then assign permissions
to them. By doing it this way, gives you more control over new files and folders that are
created and also gives you the ability to manage the permissions of the folder, files
and sub folders from one point. In this example, I will create a folder in
which users can place files but not delete them. Also they will be able to list any files
that are in the folder. Once I enter in the permission’s they will appear as special
permission’s. Remember that the permissions a user receives
are a combination of the groups they are in. If I select the tab effective permission’s
and then enter in a user account. Notice that the user still has permissions to everything
even though I just assigned them special permissions. The effective permission’s tab is a good
way to troubleshoot the permission’s allocated to a user.
If I go back to the permission’s tab, notice that authenticated users has been given modify
access. This is where the user is getting their permissions from. To fix the problem,
I simply need to remove this entry. Now if I go back to effective permission’s
and select the user again, this time the user has the special permissions
that I configured earlier. In this video and the last video I looked
a configuring NTFS permission. NTFS permissions help protected your files from
unauthorized access. In the next video I will look at how to configure encryption on your
files. Encryption is anther method you can use to protect your files. For more free videos
for this completely free Windows 7 training course, check out our web site or you tube
channel. Thanks for watching.