Welcome back to your free training course for windows 7 for the 70 680 exam. This video
and the rest of the course are always available on YouTube. In this video I will look at
NTFS permissions. NTFS permissions are applied to a file or folder in order to allow
or deny access. There are five standard permissions for NTFS.
First you have list folder content. This is only applied at the folder level. If the user
has this level of access they can view the contents of a folder to see what files and
folders are in that folder. This does not give them access to read or write anything
in the folder, but does allow them to see what files are present.
The next permission is read. This permission allows the user to read files but not make
changes to them. If the file is an executable they will be able to read the file but will
not be able to run the file. The next permission, write allows you to write
to a folder or file but the user can’t delete the file or folder. The next permission modify
allows reading and writing to a file or folder but also allows the user to delete the file
or folder. This is the most commonly assigned permission on most networks to end users.
The modify permission allow the user to make changes to files and folder but not to change
the permissions of files or folders. If the end user was able to change the permissions
of file or folders they may lock themselves out or prevent other people who need access
accessing the files or folders. The last permission is full control. This
permission allows the user to read, write and delete but also gives them the power to
change permissions and change the owner of the file. Generally full control is given
to administrators only. Once you decide which permissions you want
to give you have a choice of allow or deny. Allow permissions are accumulatively. If you
belong to multiple groups you get all the access that those groups allow. The deny permission
however over rides all other permissions. If you are thinking about assigned the deny
permission it would be best to think again. In most cases it is not necessary and can be avoided.
To illustrate why consider this. User John Doe is a member of Sales group.
He is given access to a folder called invoices. Later on it is decided that the Sales department
should not have access to the invoices folder so you deny the Sales group access to the
folder. Anther user Jane Doe is in Accounting. She
sometimes needs to access files that the Sales group has access to so she is a member of
the accounting group and the sales group. Once you change the permission to deny she
no longer has access to the invoice folder that is essential to do her job. As you can
imagine she is not amused. In this scenario, if you want to deny access
to the sales group from the invoices folder you would simply remove their access. This
would prevent the sales group from accessing the folder, but would also allow anyone in
the accounting group to still access the folder. See that with careful planning using the deny
permission is not required. The deny permission does sometimes have its place, but think twice
before using it as they often cause problems later on.
Once you understand which permissions are available and how to set allow and deny permissions,
the next thing to understand is explicit and inherited permissions. Explicit permissions
are permissions that are assigned directly to the file or folder.
Inherited permissions are permissions that are assigned from the folder above. New files
and folders added to this folder will automatically receive the permissions from that folder.
The advantage of inherited permissions is that you can control NTFS permissions for
a complete folder hierarchy from a single point.
To illustrate this, consider this hierarchy of folders. You can assign the read permission
to a folder called public. All the folders below this will now inherited the read permission
assigned to that folder. There is a folder in the hierarchy called invoices you only
want the accounting department to have access to. You removed the inherited permissions
from this folder and assigned it explicit permissions.
The permissions are the account department has modify access. It is later decided that
a new department called audit is created which needs access to everything. Notice how easy
it is to add the audit group to public folder and all the other folder access change automatically
expect for the folder that is explicitly assigned. If you want to allow the audit group access
to the invoice directory you will need to manually change it. Note however that just
because a directory has explicit permissions does not mean that inheritance is disabled.
Any folder created under the invoice folder can inherited the permissions from the one
above it. Explicit permissions also work on the file level. If I for example allocated
explicit permissions to a file a folder in the hierarchy, it’s permissions would no
longer change if the permissions above it changed.
Now this brings up the next topic, copying and moving files. So what happens if I move
or copy a file from one location to another? If I move a file from the same volume to another
location on the same volume the permissions are kept. For example, if I move this file
from here to here it will keep its explicitly set permissions.
This is the only time this happens. All other combinations will inherit the permissions
of the folder where it is being copied to. For example, if I now copy this file to another
part of the tree it will inherit the permissions from the folder to where it is copied to.
If I move or copy the file to anther volume, it will inherit the permissions from that
folder. Moving files on a local system can sometimes cause some unwanted side effects.
For this reason if you want to move a file on the same volume but want it to inherit
the permissions of the new folder, I would copy the files to the new location and then
delete the old files rather then moving. Doing this ensures the files do not keep their old
permissions. Once you start copying, moving and setting
permissions you may accidently lock yourself out of a file or maybe someone else locks
themselves out of the file. Windows comes with a kind of back door when this occurs.
Every file and folder on the system has an owner. The owner of the file has the ability
to change permissions of any file or folder they are the owner of. For example, if you
only have read access and you are the owner you can change the permissions of the file
giving you access. If you remove all your access and have no
permissions at all, if you are the owner you can give yourself access. Even if you go so
far as deny yourself access to the file you can give yourself access. But what happens
if you are not the owner of the file and need access to a file.
Windows has anther back door which allows an administrator to change the owner of a
file or folder. Once an administrator is the owner of a file they can then assign permissions
to that file. This is an important fact to remember because even an administrator can’t
change the permissions of a file or folder that they are not the owner of and don’t
have permissions for it. I will now switch to my windows 7 computer so we can have a better
look at how NTFS permissions work. First of all to demonstrate now inheritance
works on a hard disk I will start at the top and open the properties of the c drive. If
I go to the security tab I can see all the permissions set on this drive. Any new folders
created on this drive will inherit these permissions. Selecting the system user will show that the
user has full control. Below this are the other permissions that I talked about earlier.
“Modify”, “read & execute”, “list folder contents”, “read” and “write”.
If I select administrators, the permissions are set the same, however selecting users
will show that the average user will be given read & execute, list folder contents and read.
This means by default administrators and the system user have full control over any new
folder created while the users will only be able to read.
To demonstrate this better, I will created a new folder on the c drive called NTFS
demo. Going into the properties of this folder and selecting the security tab shows that
this folder has the same permissions as the root of the c drive.
In this case I want to give the user access to write to the folder since at present they
only have read access. To do this, press the edit button. Select users and then select
the permission you want to add, in this case modify.
Going back to the previous screen the modify permission has been added. Notice that the
permissions read & execute, list folder contents and read have grey ticks. These permissions
are still being inherited from the c drive, all I have done is added additional permissions
to the list. Now that I have set the permissions for the
folder, I will go into the folder can create a new file. Going into the properties for
the file and select the security tab will show that the file has inherited the permission
from its parent folder NTFS demo. In some cases you may want to change the
NTFS permission completely. To do this, select the button advanced. From here select the
option change permissions. To set only my permissions, I need to clear
the tick box include inheritable permissions from this object’s parent. Once I clear
the tick box I will be given a dialog asking what the initial permissions should be.
The first option is add. What this does is it copies the inherited permissions to the
file. In this case I will select the option remove
which will remove all the permissions for the file. When I do this I get a message telling
me that no one will be able to access the file until I assign permissions to it.
Once I proceed and remove the permissions and go back to windows explorer and try and
open the file I will get a message saying access is denied. Even though I am logged
in as an administrator I will not have access to the file.
Since I am the owner of the file, I can still go back into the properties of the file and
edit the NTFS security on the file. To demonstrate this fact more clearly, I am going
to deny everyone access to the file and ignore the error from windows telling me this is
a bad idea. If I select the owner tab you can see that
the trainer account, the administrator account I am logged in as, is still the owner and
thus can still make changes to the permissions. Even though I have deny accessed to everyone,
while I am the owner of the file I still have this back door available to change the permissions
if I need to. If I press edit I can now change the owner
of the file. Once I select a new owner and exit back to windows explorer. I have now
effectively locked myself out of the file for this user. This user is an administrator
so I can change ownership back to myself if I want to.
In this case there is only one file, but imagine you had 100’s of files. You would not want
to manually select each file and change it. To perform the actions on all files and folders
under the parent folder I will select the folder NTFS demo and select the properties.
Once again I will select the security tab and then press the button advanced. Just to
prove a point, I am going to attempt to change the permissions of the files under this directory.
To do this, tick the option replace all child object permissions with inheritable permissions
from this object. I will get a dialog asking if I want to replace
all the permissions, this action will effectively reset all the permissions for all the files
and folders under NTFS demo. Once I press yes I will get an error message telling me
that Windows was not able to change the security for the NTFS demo document. This is because
I change the permission to deny for everyone. To get around this, I need to first change
the owner of the file. To do this, select the owner tab, press edit and then select
the tick box at the bottom, replace owner on sub containers and objects. Once I press
O.K., the owner of all the files and folders under this folder will be replaced. Now that
I have changed the owner I can go back to the security tab and reset all the permissions
in the NTFS folder. NTFS permissions may seem a bit complex
at first but with time you will get the hang of them. Just remember that the owner of a
file or folder can change the permissions to anything they want regardless of what they
are currently set to. Administrators can change the owner at any
time. You can also see how being an administrator on a system gives you access to anything you
want. This is how an off line attack works. By removing a hard disk from a system and
putting it in anther system you can get access to any file or folder on that hard disk you
want regardless of what permissions are set. In the next video I will look at some of the
more advanced features of NTFS permissions. I will also look at how NTFS and share
permissions work when combined together. Thanks for watching this completely free course on
windows 7. For more videos please see are web page or are you tube channel. Thanks for
watching.