Logo
programming4us
programming4us
programming4us
programming4us
Home
programming4us
XP
programming4us
Windows Vista
programming4us
Windows 7
programming4us
Windows Azure
programming4us
Windows Server
programming4us
Windows Phone
 
Windows Vista

Configure and Troubleshoot Access to Resources (part 1) - Permissions

- Windows 10 Product Activation Keys Free 2019 (All Versions)
- How To Bypass Torrent Connection Blocking By Your ISP
- How To Install Actual Facebook App On Kindle Fire
3/13/2011 10:20:40 PM
The whole reason to build and administer a network is to provide users with access to resources to make them more productive. When this access fails, users get cranky, bosses get cranky, and an administrator’s day just got worse. In the following sections you look at permissions for folder and file access, access to printers, and ways to provide secure access for LAN-based connections as well as for remote-access clients.

Permissions

Permissions have always been a target for the Microsoft Certification exams. Let’s run through a quick review of how permissions work.

You basically have six functional permissions:

  • R (Read)

  • W (Write)

  • X (Execute—The ability to run programs)

  • D (Delete)

  • P (Permissions—The ability to change permissions on a file or folder)

  • O (Ownership—The ability to take or assign ownership of a file or folder)

These permissions are combined into practical combinations and can be assigned in two possible places:

  • On the NTFS partition— Managed by the NTFS file system

  • At the share point— Managed by the Server service (File and Printer Sharing)

Figure 1 shows, on the NTFS partition, at the folder and file level, the permissions that can be granted; these permissions are described in Table 1.

Figure 1. NTFS permissions are located on the Security tab of the folder’s or file’s properties.


Table 1. NTFS Partition Folder/File Permissions
NTFS PermissionsFunctional Equivalent
Full ControlR W X D P O
ModifyR W X D
Read & ExecuteR X
List folder contents[*]R X
ReadR
WriteW
Special PermissionsAny custom combination of permissions

[*] Only available on NTFS folders. This permission also requires X on the executable file to run a program.

Also notice in Figure 1 that there are Allow permissions and Deny permissions. Deny permissions are all-powerful and dominate 100% of Allow permissions that may be granted through other group memberships for the configured Deny.

Only folders can be shared. You cannot share a discrete file. Figure 2 shows, on a shared folder, the permissions that can be granted; these permissions are described in Table 2.

Figure 2. Share permissions are located on the Sharing tab of the shared folder’s properties. After selecting these permissions, you can select Advanced Sharing > Permissions.


Table 2. Share Permissions
Share PermissionsFunctional Equivalent
Full ControlR W X D P O
ChangeR W X D
ReadR X

 Alert

Notice that in both cases, only the Full Control permission allows you to change the Permissions (P) and the Ownership (O) of the folder or file.


Determining Effective Permissions for the Interactive User

If you sit down at the computer where the files and folder are, you are only subject to the NTFS permissions as you try to access the files on the NTFS partition. In this case you are a member of the Interactive group.

As a member of the Interactive group, your user account and all the groups that you are a member of (including the Interactive group) get compared to the Access Control List (ACL) on the file or folder you are accessing, where you may be granted different combinations of Allow permissions and Deny permissions. Remember that the Deny permissions are all powerful and overrule any Allow permissions.

First, you add all the Allow permissions.

Next, you subtract any Deny permissions.

The permissions that remain are your effective NTFS permissions and define your access level when you are a member of the Interactive group.

Table 3 shows how to determine the effective permissions for an interactive user. User1 is a member of the Managers group, the Production group, and the Bad Boys group. Because he is an interactive user, only NTFS permissions apply to his access.

Table 3. Effective NTFS Permission Exercise
 File1.txt (NTFS)Functional Equivalent
User1No permissions set 
ManagersAllow ModifyR W X D
ProductionAllow ReadR X
Bad BoysDeny W, D-W -D
 Allow =R W X D
 Deny =-W -D
 Effective =R X

Microsoft has also added a tab to the file and folder Advanced Properties to calculate the NTFS effective permissions. This calculation does not include share permissions.

Determining Effective Permissions for the Network User

If you access files and folders over the network from a remote computer, your access requests must first pass through the share point, being subject to the permissions that are managed by the Server service. Then you must still access the files and folders on the NTFS partition. So you are subject to both share permissions and NTFS permissions combined. In this case you are a member of the Network group.

Alert

First, you must pass through the share point, so you add up all the Allow permissions at the share point.

Next, you subtract away any Deny permissions at the share point.

The permissions that remain are your effective share permissions.

Then you must access the file on the NTFS partition, so you add up all the NTFS Allow permissions on the file.

Next, you subtract away any NTFS Deny permissions on the file.

The permissions that remain are your effective NTFS permissions.

Now you have a share permissions list and an NTFS permissions list. Whatever permissions the two lists have in common are your effective Network access permissions for the target file.


Look at the example in Table 4 for determining the effective permissions for a network user. User1 is a member of the Managers group, the Production group, and the Bad Boys group. Because he is a Network user, both share and NTFS permissions apply to his access.

Table 4. Effective Permissions Through a Share
 Share PermissionsFunctional Equivalent
User1Allow Full ControlR W X D P O
ManagersAllow ChangeR W X D
ProductionNo permissions set 
Bad BoysNo permissions set 
 Allow =R W X D
 Deny = 
 Effective Share =R W X D P O
 File1.txt (NTFS)Functional Equivalent
User1No permissions set 
ManagersAllow ModifyR W X D
ProductionAllow ReadR X
Bad BoysDeny W, D-W -D
 Allow =R W X D
 Deny =-W -D
 Effective NTFS=R X

User1’s effective permissions as a Network user are what the two lists, Share permissions and NTFS permissions, have in common. User1 is allowed to read folder content and read and execute files. That’s it. All other Allow permissions have been stripped away.

In this example, the NTFS permissions do not have the W, D, P, and O permissions. The only permissions that the two lists have in common are R and X.

Other -----------------
- Windows Update (part 4) - Troubleshooting Updates
- Windows Update (part 3) - Windows Server Update Services Server (WSUS)
- Windows Update (part 2) - Automatic Updates
- Windows Update (part 1) - Manual Updates
- Windows Defender and Other Defenses Against Malware
- Windows Firewall
- Troubleshoot Security Configuration Issues (part 2) - Securing Data in Storage with Encrypting File System & Securing Computers with the Security Configuration and Analysis Tool
- Troubleshoot Security Configuration Issues (part 1) - The Windows Security Center & Securing the Operating System and Data in Storage with BitLocker
- Configure and Troubleshoot Security for Windows Internet Explorer 7 (part 4) - Digital Certificates
- Configure and Troubleshoot Security for Windows Internet Explorer 7 (part 3) - Cookie-Handling & ActiveX Opt-In
 
 
Top 10
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 2) - Wireframes,Legends
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 1) - Swimlanes
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Formatting and sizing lists
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Adding shapes to lists
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Sizing containers
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 3) - The Other Properties of a Control
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 2) - The Data Properties of a Control
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 1) - The Format Properties of a Control
- Microsoft Access 2010 : Form Properties and Why Should You Use Them - Working with the Properties Window
- Microsoft Visio 2013 : Using the Organization Chart Wizard with new data
Popular tags
Microsoft Access Microsoft Excel Microsoft OneNote Microsoft PowerPoint Microsoft Project Microsoft Visio Microsoft Word Active Directory Biztalk Exchange Server Microsoft LynC Server Microsoft Dynamic Sharepoint Sql Server Windows Server 2008 Windows Server 2012 Windows 7 Windows 8 windows Phone 7 windows Phone 8
programming4us programming4us
Celebrity Style, Fashion Trends, Beauty and Makeup Tips.
 
programming4us
Windows Vista
programming4us
Windows 7
programming4us
Windows Azure
programming4us
Windows Server