TOP NEWS: iPhone 4 to ring in Singapore on Friday

ZDNet / Techguide / Network Admin

Dissecting default NTFS permissions

By , TechRepublic on May 7, 2009

 

Summary

Make sure you understand what each of the NTFS file permissions includes and how they are inherited through the hierarchy to close up security gaps.

Events

IT Priorities 2010

Sydney, Australia - 27 Jul 2010
Melbourne, Australia - 28 Jul 2010
Mumbai, India - 4 Aug 2010
Delhi, India - 6 Aug 2010

IDC's Asia/Pacific Cloud Computing Conference 2010
31 Aug 2010

Marriott Hotel, Singapore

In this post, I am referring to the permissions on Windows Vista Business Edition. The different versions of Windows, such as Windows NT, Windows 2000, 2003, XP, and 2008, may differ only slightly as far as what the permissions are made up of.

The default application of these permissions is entirely another story. For instance in Windows 2000, the Everyone group had the Full Control default NTFS permission at the C:\ level, and these permissions were inherited through the hierarchy--not a very good security practice. Other versions of Windows have improved in their application of these default permissions.

For most applications, the default NTFS permissions are sufficient. So what are these default permissions?

1. Full Control
2. Modify
3. Read and Execute
4. List Folder Contents
5. Read
6. Write

Generally speaking, if someone has Modify permission, they have the other permissions as well when editing files or folders is concerned. Read and Execute has Read and List Folder Contents and so on…. Write permission has a slight exception and is isolated because there are circumstances in which you might want someone to write to a file or folder but not be able to read it.

The other permission that is considered "key to the kingdom" is Full Control. The Full Control permission not only gives you access to the permissions needed to edit files and folders but also controls the ability to modify access to the file or folder.

These default permissions are actually made up of individual permissions, which I will show in Table A.

Table A

 

FC

M

R&E

LFC (folders only)

R

W

Full Control

P

 

 

 

 

 

Traverse Folder/Execute File

P

P

P

P

 

 

List Folder/Read Data

P

P

P

P

P

 

Read Attributes

P

P

P

P

P

 

Read Extended Attributes

P

P

P

P

P

 

Create Files/Write Data

P

P

 

 

 

P

Create Folders/Append Data

P

P

 

 

 

P

Write Attributes

P

P

 

 

 

P

Write Extended Attributes

P

P

 

 

 

P

Delete Subfolders and Files

P

 

 

 

 

 

Delete

P

P

 

 

 

 

Read Permissions

P

P

P

P

P

P

Change Permissions

P

 

 

 

 

 

Take Ownership

P

 

 

 

 

 

Notice how the individual permissions for Read and Execute, List Folder Contents, and Read are very similar yet the applications are quite different.

The other thing to keep in mind with the different permissions is where they are being applied. The default characteristic of permissions is that they will be inherited throughout the hierarchy to as low as possible.

The possible choices when checking your options to modify how these permissions are applied are:

  • this folder only
  • this folder, subfolders, and files
  • this folder and subfolders
  • this folder and files
  • subfolders and files only
  • subfolders only
  • files only

The default permission application is this folder, subfolders, and files, which explains inheritance.

As for options, depending on circumstance, you might want to restrict the application of permissions. For instance, control access to C:\Windows.

The purpose of my dissection here was just to take a look under the covers of NTFS file permissions and consider what the defaults are. What is your experience? Do you have any foolproof permission application formulas?

Brad Bird is director of security and strategic solutions for IGI. He lives in Ottawa, Canada. He specializes in Windows systems, security and network administration. You can find more of Brad's blog posts at Rantings of an IT Pirate.

Talkback

Add your opinion

In order to post a comment, you need to be registered. (Sign In or register below)

Post your comment
Access data anywhere in the private cloud & enable entirely new efficiencies with EMC VPLEX.
Tech Vendor: EMC

Network Admin TechGuides

SNMP security: Maligned or ignored, but useful for risk management

Secret agents: Make SNMP work for you

Remote site bandwidth challenges and opportunities

Jump boxes vs. firewalls

Troubleshooting BSOD when saving files to the network in Windows XP

Deploying isolated VLANs in your network

7 tips for replacing a firewall

Can Wi-Fi keep up with today's applications?

What do the new Windows networking protocols do?

Determine physical location of IP addresses with these resources

More

ZDNet Asia Live

RT @Droid_News: Motorola earnings beat expectations http://bit.ly/btsNAg | #Droid #Android

US court rejects class action status for Intel antitrust suit http://bit.ly/cWeSQZ

US court rejects class action status for Intel antitrust suit http://bit.ly/9mqiJR

http://bit.ly/8v7Ov3 US court rejects class action status for Intel antitrust suit - ZDNet Asia http://is.gd/dSz7R

18 minutes ago by easytweeting on topsy

US court rejects class action status for Intel antitrust suit http://bit.ly/9AbnMF

Non-green IT products 'marketing suicide': This 50-hectare eco-business park is described as a "living laboratory"... http://bit.ly/aCqko4

great! US court rejects class action status for Intel antitrust suit http://bit.ly/9acwER Good day!

Shocked! RT: @danielgoh: Oh really? RT @scoopsg: (zdnetasia) S'pore marketeers not chirping to Twitter's tune http://scoo.ps/dpkySs

Non-green IT products 'marketing suicide': By Munir Kotadia, ZDNet Australia on July 30, 2010 (8 minutes ago) Vend... http://bit.ly/aCqko4

Asian firms aware of IT snoops. http://bit.ly/9eGRxG

sg marketeers not chirping to twitter's tune http://bit.ly/aRAa1Y - baby steps baby steps

Non-green IT products 'marketing suicide': This 50-hectare eco-business park is described as a "living laboratory"... http://bit.ly/cEkDUD

Non-green IT products 'marketing suicide': At the same time, it seems vendors see green technology as a very high ... http://bit.ly/aCqko4

1 hour 18 minutes ago by greentreats on topsy

Oh really? RT @scoopsg: (zdnetasia) S'pore marketeers not chirping to Twitter's tune http://scoo.ps/dpkySs

@mrcolinlim but of course for more tech updates you can always visit zdnetasia.com

RT @zdnetasia: Searchable Facebook user data posted to Pirate Bay http://bit.ly/ciJQxY

2 hours 15 minutes ago by phyllis777loves on topsy

in the mean time, if you need to find PDF eBooks, you may use http://www.findpdf.us/

4 hours 54 minutes ago by findpdf on Researchers find workaround for Adobe PDF fix

Just want to say what a great blog you got here! My appreciation of your work, cause i am an IT student also. Try this one too, http://w...

5 hours 2 minutes ago by winsource on Making the case for Filipino IT entrepreneurship

Hi, We have ton of HP empty cartridges. Could you collect them in our office??
Thanks

1 day 55 minutes ago by Pacific Time Pte Ltd on Recycle your HP print cartridges and get rewards

Thanks Kenneth, for your insights. Good to know people out there can see the issue for what it is, and to do so impassively, that is. ...

2 days 180027 seconds ago by yedwin on iPhone 4 shows prudence in procrastination

While I agree that the issues with the device have raised many an eyebrow, I think it's unwise to forget that many phone reviews have...

2 days 12 minutes ago by kennethkoh on iPhone 4 shows prudence in procrastination

The online apple store http://store.apple.com/ is not available now. Maybe it's updating the pricing ;)

2 days 10 minutes ago by mingnow on iPhone 4 to ring in Singapore on Friday

After an awful silence, finally the prices are out..

3 days 5 minutes ago by melvinchia on iPhone 4 to ring in Singapore on Friday

Glad you discovered the Xfce 4.6 magic. Its other endearing feature is its phenomenal configurability. You can make the desktop look and ...

3 days 12 minutes ago by gnome_refugee on Smitten with Xfce 4

yep, tried them all and xfce with compiz/emerald instead of fvwm is by far the best experience I've had. If you didn't know ther...

3 days 10 minutes ago by ggolemg on Smitten with Xfce 4

@mingnow: why do you think so? How do you think the FOSS community could tackle this issue? I'm involved in a lot of efforts to get t...

3 days 16 minutes ago by fredericmuller on Taobao initiates Chinese open source revolution

Geez. I would think giving free books and getting kids to school would be a better place to start.

3 days 24 minutes ago by mingnow on India's US$35 tablet--how low can it go?

I think it's great the that country with the biggest internet population is finally contributing back to the open-source world. I thi...

4 days 10 minutes ago by mingnow on Taobao initiates Chinese open source revolution

hey.there Im Wendy from a PR Agency.I find your blog interesting and well written.In days to come,we would hold an event. Therefore We ...

4 days 41 minutes ago by wendy on iPhone 4 shows prudence in procrastination

It could be done without all these. Just use the opacity addon of Compiz.

4 days 5 minutes ago by hariks0 on How to get RGBA support in Ubuntu

Keep Up With ZDNet Asia

Facebook Join our fan page

RSS Feeds Subscribe now

Newsletters Subscribe today

Twitter Follow us

Whitepapers

Five Virtualised Data Centres Deliver Cloud Computing: Cisco Network Is the Platform for ITricity's 'on Demand' Computing Services in Holland

Consumers and Convergence - attitudes are changing...

Smart Work in Action - Customer Stories

Welcome to the CDW Security Assessment

CDW Secure Remote Access Solutions - Tools & Trends

Downloads

WFilter Enterprise

PC File Transfer

MetaPing FREE Visual Ping Monitor

Remote Administrator Control Client Lite

RouterPassView

Network Admin News

APAC public sector enterprise networking spend to grow

HP bets on interoperability to win networking market

S'pore govt sets aside $798M for new systems

Vodafone to sell the iPhone next year

Short stay for 3D Networks CEO Avakian

Tech Jobs Now!

Certis CISCO Auxiliary Police Inspector / ASP

Senior Electrical Engineers Wireless Accessories (Req No: 91588)

IT AND VOIP PROFESSIONAL

Loan Officer INVITATION ONLY NETWORKING EVENT (August 9, 2010) Indianapolis, IN

Network Consulting Engineer

Search for jobs

Inside ZDNet Asia

IT Priorities Round Table series 2010

Latest Videos on Tech Industry

Insight: Interviews with Newsmakers

Find Tech Jobs and
Career Resources

Find your Tech answers in TechGuides

IT Library: Over 60,000 IT papers at your fingertips

Download IT Priorities 2010 Report