ALS Microsoft® Windows® 2000 Active Directory® Services

Author Microsoft Corporation Pages 912 Disk N/A Level Beg/Int Published 11/29/2000 ISBN 9780735610453	More Information About the Book Table of Contents Sample Chapter Index Related Series Related Books About the Author Support: Book & CD

Chapter 9: Securing Network Resources

• About This Chapter
• Before You Begin
• Lesson 1: Understanding NTFS Permissions
• NTFS Permissions
• NTFS Folder Permissions
• NTFS File Permissions
• Access Control List
• Multiple NTFS Permissions
• NTFS Permissions Inheritance
• Lesson Summary
• Lesson 2: Assigning NTFS Permissions
• Planning NTFS Permissions
• Setting NTFS Permissions
• Practice: Planning and Assigning NTFS Permissions
• Lesson Summary
• Lesson 3: Assigning Special Permissions
• Special Permissions
• Setting Special Permissions
• Taking Ownership of a File or Folder
• Practice: Taking Ownership of a File
• Lesson Summary
• Lesson 4: Copying and Moving Files and Folders
• Copying Files and Folders
• Moving Files and Folders
• Practice: Copying and Moving Folders
• Lesson Summary
• Lesson 5: Troubleshooting Permissions Problems
• Troubleshooting Permissions Problems
• Avoiding Permissions Problems
• Practice: Deleting a File with All Permissions Denied
• Lesson Summary
• Review

Securing Network Resources

About This Chapter

This chapter introduces you to Microsoft Windows 2000 file system (NTFS) folder and file permissions. You will learn how to assign NTFS folder and file permissions to user accounts and groups, and how moving or copying files and folders affects NTFS file and folder permissions. You will also learn how to troubleshoot common resource access problems.

Before You Begin

To complete the lessons in this chapter, you must have

• Completed the Setup procedures located in "About This Book"
• Completed the exercises and obtained the knowledge and skills covered in Chapter 7, "User Account Administration" and Chapter 8, "Group Account Administration"
• Configured the computer as a domain controller in a domain

Lesson 1: Understanding NTFS Permissions

NTFS permissions are rules associated with objects that regulate which users can gain access to an object and in what manner. This lesson introduces standard NTFS folder and file permissions. It also explores the effects of combining user account and group permissions with file and folder permissions.

• Define standard NTFS folder and file permissions
• Describe the result when multiple NTFS permissions are applied to a resource
• Describe the result when you combine user account and group permissions for a resource

Estimated lesson time: 10 minutes

NTFS Permissions

Use NTFS permissions to specify which users and groups can gain access to files and folders, and what they can do with the contents of the file or folder. NTFS permissions are only available on NTFS volumes. NTFS permissions are not available on volumes that are formatted with the file allocation table (FAT) or FAT32 file systems. NTFS security is effective whether a user gains access to the file or folder at the computer or over the network. The permissions you assign for folders are different from the permissions you assign for files.

NTFS Folder Permissions

You assign folder permissions to control the access that users have to folders and to the files and subfolders that are contained within the folder.

Table 9.1 lists the standard NTFS folder permissions that you can assign and the type of access that each provides.

Table 9.1 NTFS Folder Permissions

NTFS Folder Permission	Allows the User To
Full Control	Change permissions, take ownership, and delete subfolders and files, plus perform actions permitted by all other NTFS folder permissions
Modify	Delete the folder plus perform actions permitted by the Write permission and the Read & Execute permission
Read & Execute	Move through folders to reach other files and folders, even if the users do not have permission for those folders, and perform actions permitted by the Read permission and the List Folder Contents permission
List Folder Contents	See the names of files and subfolders in the folder
Read	See files and subfolders in the folder and view folder ownership, permissions, and attributes (such as Read-only, Hidden, Archive, and System)
Write	Create new files and subfolders within the folder, change folder attributes, and view folder ownership and permissions

You can deny folder permission to a user account or group. To deny all access to a user account or group for a folder, deny the Full Control permission.

NTFS File Permissions

You assign file permissions to control the access that users have to files. Table 9.2 lists the standard NTFS file permissions that you can assign and the type of access that each provides.

Table 9.2 NTFS File Permissions

NTFS File Permission	Allows the User To
Full Control	Change permissions and take ownership, plus perform the actions permitted by all other NTFS file permissions
Modify	Modify and delete the file plus perform the actions permitted by the Write permission and the Read & Execute permission
Read & Execute	Run applications plus perform the actions permitted by the Read permission
Read	Read the file, and view file attributes, ownership, and permissions
Write	Overwrite the file, change file attributes, and view file ownership and permissions

Access Control List

NTFS stores an access control list (ACL) with every file and folder on an NTFS volume. The ACL contains a list of all user accounts and groups that have been granted access for the file or folder, as well as the type of access that they have been granted. When a user attempts to gain access to a resource, the ACL must contain an entry, called an access control entry (ACE), for the user account or a group to which the user belongs. The entry must allow the type of access that is requested (for example, Read access) for the user to gain access. If no ACE exists in the ACL, the user cannot gain access to the resource.

Multiple NTFS Permissions

You can assign multiple permissions to a user account by assigning permissions for a resource to an individual user account and to each group of which the user is a member. You need to understand the rules and priorities that are associated with how NTFS assigns and combines multiple permissions. You also need to understand NTFS permission inheritance.

A user's effective permissions for a resource are the sum of the NTFS permissions that you assign to the individual user account and to all of the groups to which the user belongs. If a user has Read permission for a folder and is a member of a group with Write permission for the same folder, the user has both Read and Write permission for that folder.

NTFS file permissions take priority over NTFS folder permissions. A user with access to a file will be able to gain access to the file even if he or she does not have access to the folder containing the file. A user can gain access to the files for which he or she has permissions by using the full Universal Naming Convention (UNC) or local path to open the file from its respective application, even though the folder in which it resides will be invisible if the user has no corresponding folder permission. In other words, if you do not have permission to access the folder containing the file you want to access, you must know the full path to the file to access it. Without permission to access the folder, you cannot see the folder, so you cannot browse for the file you want to access.

You can deny permission to a user account or group for a specific file, although this is not the recommended way to control access to resources. Denying permission overrides all instances where that permission is allowed. Even if a user has permission to gain access to the file or folder as a member of a group, denying permission to the user blocks any other permission that the user might have (see Figure 9.1).

Figure 9.1 Multiple NTFS permissions

In Figure 9.1, User1 has Read permission for FolderA and is a member of Group A and Group B. Group B has Write permission for FolderA. Group A has been denied Write permission for File2.

User1 can read and write to File1. The user can also read File2, but she cannot write to File2 because she is a member of Group A, which has been denied Write permission for File2.

NTFS Permissions Inheritance

By default, permissions that you assign to the parent folder are inherited by and propagated to the subfolders and files that are contained in the parent folder. However, you can prevent permissions inheritance, as shown in Figure 9.2.

Figure 9.2 Permissions inheritance

Files and subfolders can inherit permissions from their parent folder. Whatever permissions you assign to the parent folder can also apply to subfolders and files that are contained within the parent folder, depending on the inheritance option set for a given object. When you assign NTFS permissions to give access to a folder, you assign permissions for the folder and for any existing files and sub folders, as well as any new files and subfolders that are created in the folder.

You can prevent permissions that are assigned to a parent folder from being inherited by subfolders and files that are contained within the folder by setting an inheritance option set for a given object. That is, the subfolders and files will not inherit permissions that have been assigned to the parent folder containing them.

If you prevent permissions inheritance for a folder, that folder becomes the top parent folder. Permissions assigned to this folder will be inherited by the subfolders and files that it contains.

Lesson Summary

In this lesson you learned how NTFS permissions are used to specify which users and groups can gain access to files and folders, and what these permissions allow users to do with the contents of the files or folders. NTFS permissions are only available on NTFS volumes. You also learned that the folder permissions are Full Control, Modify, Read & Execute, List Folder Contents, Read, and Write. The file permissions are similar to the folder permissions. The file permissions are Full Control, Modify, Read & Execute, Read, and Write.

You learned about applying NTFS permissions. NTFS stores an ACL with every file and folder on an NTFS volume. The ACL contains a list of all user accounts and groups that have been granted access for the file or folder, as well as the type of access that they have been granted.

You also learned that you can assign multiple permissions to a user account by assigning permissions to the individual user account and to each group of which the user is a member. You learned that NTFS file permissions take priority over NTFS folder permissions.

Finally, you learned how permissions that you assign to the parent folder are inherited by and propagated to the subfolders and files that are contained in the parent folder by setting an inheritance option set for a given object. When permissions inheritance is prevented for a folder, the folder at which you prevent inheritance becomes the new parent folder. Permissions assigned to this folder will be inherited by the subfolders and files that are contained within it. Permissions inheritance can also be prevented for a file.

Lesson 2: Assigning NTFS Permissions

There are certain guidelines you should follow for assigning NTFS permissions. Assign permissions according to group and user needs; this includes allowing or preventing permissions inheritance from parent folders to subfolders and files that are contained in the parent folder. This lesson presents guidelines for planning NTFS permissions and then walks you through the steps of assigning NTFS permissions.

• Plan what permissions to assign to users or groups for applications and data folders
• Assign NTFS folder and file permissions to user accounts and groups

Estimated lesson time: 60 minutes

Planning NTFS Permissions

If you take the time to plan your NTFS permissions and follow a few guidelines, you will find that NTFS permissions are easy to manage. Use the following guidelines when you assign NTFS permissions:

1. To simplify administration, group files into application, data, and home folders. Centralize home and public folders on a volume that is separate from applications and the operating system. Doing so provides the following benefits:

• You assign permissions only to folders, not to individual files.
• Backup is less complex because there is no need to back up application files, and all home and public folders are in one location.

2. Allow users only the level of access that they require. If a user only needs to read a file, assign the Read permission to his or her user account for the file. This reduces the possibility of users accidentally modifying or deleting important documents and application files.
3. Create groups according to the access that the group members require for resources, and then assign the appropriate permissions to the group. Assign permissions to individual user accounts only when necessary.
4. When you assign permissions for working with data or application folders, assign the Read & Execute permission to the Users group and the Administrators group. This prevents application files from being accidentally deleted or damaged by users or viruses.
5. Turn off the permissions inheritance option at the home directory level. This allows the user to consider permissions for each file or folder in the home directory.
6. When you assign permissions for public data folders, assign the Read & Execute permission and the Write permission to the Users group, and the Full Control permission to CREATOR OWNER identity group. The user who creates a file is by default the creator and owner of the file. After you create a file, you may grant another user permission to take ownership of the file. The person who takes ownership would then become the owner of the file. If you assign the Read & Execute permission and the Write permission to the Users group, and the Full Control permission to CREATOR OWNER, users have the ability to read and modify documents that other users create and the ability to read, modify, and delete the files and folders that they create.
7. Deny permissions only when it is essential to deny specific access to a specific user account or group.
8. Encourage users to assign permissions to the files and folders that they create and educate them about how to do so.

Setting NTFS Permissions

By default, when you format a volume with NTFS, the Full Control permission is assigned to the Everyone group. You should change this default permission and assign other appropriate NTFS permissions to control the access that users have to resources. Be careful if you assign permissions to the Everyone group and enable the Guest account. Windows 2000 will authenticate a user who does not have a valid user account as Guest. The user automatically gets all rights and permissions that you have assigned to the Everyone group.

Administrators, users with the Full Control permission, and the owners of files and folders (Creator Owner) can assign permissions to user accounts and groups.

1. Right-click the file or folder for which you want to assign permissions, then click Properties.
2. In the Security tab (see Figure 9.3) of the Properties dialog box for the file or folder, configure the options that are described in Table 9.3.



Figure 9.3 Security tab of the Properties dialog box for the Data folder

Table 9.3 Security Tab Options

Option	Description
Name	Select the user account, group, or special entity for which you want to change permissions or that you want to remove from the list.
Permission	To allow a permission, select the Allow check box. To deny a permission, select the Deny check box.
Add	Opens the Select Users, Computers, Or Groups dialog box, which you use to select user accounts and groups to add to the Name list.
Remove	Removes the selected user account, group, or special entity and the associated permissions for the file or folder.
Advanced	Opens the Access Control Settings For dialog box, which you use to add, remove, view, or edit special permissions for selected user accounts and groups.
Allow Inheritable Permissions From Parent To Propogate To This Object	Specifies whether permissions for this object will be affected by inheritance.

By default, subfolders and files inherit permissions that you assign to their parent folder. This is indicated in the Security tab in the Properties dialog box by a check in the Allow Inheritable Permissions From Parent To Propagate To This Object check box. If the check boxes under Permissions are shaded, then the file or folder has inherited permissions from the parent folder. To prevent a subfolder or file from inheriting permissions from a parent folder, clear the Allow Inheritable Permissions From Parent To Propagate To This Object check box. If you clear this check box, you are prompted to select one of the options described in Table 9.4.

Table 9.4 Preventing Permissions Inheritance Options

Option	Description
Copy	Copy the permissions from the parent folder to the current folder and then deny subsequent permissions inheritance from the parent folder.
Remove	Remove the permissions that are assigned to the parent folder and retain only the permissions that you explicitly assign to the file or folder.
Cancel	Cancel the dialog box and restore the check mark in the Allow Inheritable Permissions From Parent To Propagate To This Object check box.

Practice: Planning and Assigning NTFS Permissions

In this practice you plan NTFS permissions for folders and files based on a business scenario. Then you apply NTFS permissions for folders and files on your computer based on a second scenario. Finally, you test the NTFS permissions that you set up to make sure that they are working properly.

In this exercise you plan how to assign NTFS permissions to folders and files on a computer running Windows 2000 Server, based on the scenario described in the next section.

The default NTFS folder and file permissions are Full Control for the Everyone group. Figure 9.4 shows the folder and file structure used for this practice. You need to review the following security criteria and record the changes that you should make to the NTFS folder and file permissions to meet the security criteria.

Figure 9.4 Folder and file structure for practice

To plan NTFS permissions, you must determine the following:

• What groups to create and what built-in groups to use
• What permissions users will require to gain access to folders and files
• Whether or not to clear the Allow Inheritable Permissions From Parent To Propagate To This Object check box for the folder or file for which you are assigning permissions

Keep the following general guidelines in mind:

• NTFS permissions that are assigned to a folder are inherited by all of the folders and files that it contains. To assign permissions for all of the folders and files in the Apps folder, you need only assign NTFS permissions to the Apps folder.
• To assign more restrictive permissions to a folder or file that is inheriting permissions, you must either deny the unwanted permissions or block inheritance by clearing the Allow Inheritable Permissions From Parent To Propagate To This Object check box.

The decisions that you make are based on the following criteria:

• In addition to the default built-in groups, the following groups have been created in the domain:

• Accounting
• Managers
• Executives

• Administrators require the Full Control permission for all folders and files.
• All users will run programs in the WordProc folder, but they should not be able to modify the files in the WordProc folder.
• Only members of the Accounting, Managers, and Executives groups should be able to read documents in the Spreadsh and Database application folders by running the associated spreadsheet and database applications, but they should not be able to modify the files in those folders.
• All users should be able to read and create files in the Public folder.
• All users should be prevented from modifying files in the Public\Library folder.
• Only User81 should be able to modify and delete files in the Public\Manuals folder.

When you apply custom permissions to a folder or file, which default permission entry should you remove?

Complete Table 9.5 to plan and record your permissions.

Table 9.5 Permissions Planning Table for Exercise 1

Path	User Account or Group	NTFS Permissions	Block Inheritance (Yes/No)
Apps
Apps\WordProc
Apps\Spreadsh
Apps\Database
Public
Public\Library
Public\Manuals

In this exercise you assign NTFS permissions for the C:\Data folder (where C:\ is the name of your system drive) based on the scenario described next.

Before beginning the following exercises, create the users and groups listed in Table 9.6.

Table 9.6 Users and Groups for Exercise 2

Group	User Account
Managers	User81 (member of Print Operators)
Sales	User82 (member of Sales and Print Operators)
Sales	User83 (member of Managers and Print Operators)

Create the following folders (where C:\ is the name of your system drive):

• C:\Data
• C:\Data\Managers
• C:\Data\Managers\Reports
• C:\Data\Sales

The permissions that you assign are based on the following criteria:

• All users in the domain should be able to read documents and files in the Data folder.
• All users in the domain should be able to create documents in the Data folder.
• All users in the domain should be able to modify the contents, properties, and permissions of the documents that they create in the Data folder.

1. Log on to your domain as Administrator.
2. Right-click My Computer, then click Explore.
3. Expand the Local Disk (C:), right-click the C:\Data folder, then click Properties.

Windows 2000 displays the Data Properties dialog box with the General tab active.

4. Click the Security tab to display the permissions for the Data folder.

Windows 2000 displays the Data Properties dialog box with the Security tab active.

What are the existing folder permissions?

Notice that the current allowed permissions cannot be modified.

5. Under Name, select the Everyone group, then click Remove.

What do you see?

6. Click OK to close the message box.
7. Clear the Allow Inheritable Permissions From Parent To Propagate To This Object check box to block permissions from being inherited.

Windows 2000 displays the Security message box, prompting you to copy the currently inherited permissions to the folder or remove all permissions for the folder except those that you explicitly specify.

8. Click Remove.

What are the existing folder permissions?

1. In the Data Properties dialog box, click Add.

Windows 2000 displays the Select Users, Computers, Or Groups dialog box.

2. In the Look In list at the top of the Select Users, Computers, Or Groups dialog box, select your domain.

The Look In list allows you to select the computer or domain from which to select user accounts, groups, or computers when you assign permissions. You should specify your domain to select from the user accounts and groups that you created.

3. In the Name column, select Users, then click Add.

Users is listed in the box at the bottom of the Select Users, Computers, Or Groups dialog box.

In the box at the bottom of the Select Users, Computers, Or Groups dialog box, you can also type the name of the object you want. You can type multiple names by separating them with semicolons. If the object exists in a Windows 2000 domain or global catalog, you can type the first few characters of the name and then click Check Names. Windows 2000 either completes the name if there are no similar names, or prompts you to choose a name from a list of similar name.

4. Click OK to return to the Data Properties dialog box.

What are the existing allowed folder permissions?

5. Make sure that Users is selected, and then next to Write, select the Allow check box.
6. Click Apply to save your changes.

1. In the Security tab of the Data Properties dialog box, click Add.

Windows 2000 displays the Select Users, Computers, Or Groups dialog box.

2. In the Look In list at the top of the Select Users, Computers, Or Groups dialog box, select your domain.
3. In the Name list, select CREATOR OWNER, then click Add.

CREATOR OWNER is listed in the box at the bottom of the Select Users, Computers, Or Groups dialog box.

4. Click OK to return to the Data Properties dialog box.

What are the existing allowed folder permissions?

5. Make sure that CREATOR OWNER is selected, and next to Full Control, select the Allow check box, then click Apply to save your changes.

What do you see?

6. Click Advanced to display the additional permissions.

Windows 2000 displays the Access Control Settings For Data dialog box.

7. Under Name, select Creator Owner.

What permissions are assigned to the Creator Owner group and where do these permissions apply? Why?

8. Click OK.
9. On the Data Properties dialog box, click OK, then log off your domain.

1. Log on to your domain as User81, then start Windows Explorer.
2. Expand the C:\Data directory.
3. In the Data folder, attempt to create a text file named user81.inc.

Were you successful? Why or why not?

4. Attempt to perform the following tasks for the file that you just created, and then record those tasks that you are able to complete.

• Open the file
• Modify the file
• Delete the file

5. Close all applications, then log off Windows 2000.

In this exercise you assign NTFS permissions to the Data, Managers, Reports, and Sales folders based on the scenario described in the following section.

Assign the appropriate permissions to folders as listed in Table 9.7.

Table 9.7 Folder Permissions for Exercise 3

Folder Name	User Account or Group	Permissions
C:\Data	Users group Administrators group	Read & Execute Full Control
C:\Data\Managers	Users group Managers group Administrators group	Read & Execute Full Control Modify
C:\Data\Managers\Reports	Users group Administrators group User82	Read & Execute Full Control Modify
C:\Data\Sales	Users group Administrators group Sales group	Read & Execute Full Control Modify

1. Log on to your domain as Administrator, then start Windows Explorer.
2. Expand the Local Disk (C:).
3. Right-click the folder for which you are modifying permissions, then click Properties.

Windows 2000 displays the Properties dialog box for the folder with the General tab active.

4. In the Properties dialog box for the folder, click the Security tab.
5. In the Security tab, if you need to modify the inherited permissions for a user account or group, clear the Allow Inheritable Permissions From Parent To Propagate To This Object check box, and then when prompted to copy or remove inherited permissions, click Copy.
6. To add permissions to user accounts or groups for the folder, click Add.

Windows 2000 displays the Select User, Computer, Or Group dialog box.

7. Make sure that your domain appears in the Look In list at the top of the Select Users, Computers, Or Groups dialog box.
8. In the Name column, type the name of the appropriate user account or group, based on the preceding scenario, then click Add.

Windows 2000 displays the user account or group under Name at the bottom of the dialog box.

9. Repeat Step 8 for each user account or group that is listed for the folder in the preceding scenario.
10. Click OK to return to the Properties dialog box for the folder.
11. If the Properties dialog box for the folder contains user accounts and groups that are not listed in the preceding scenario, select the user account or group, then click Remove.
12. For all user accounts and groups that are listed for the folder in the preceding scenario, under Name, select the user account or group, and then under Permissions, select the Allow check box or the Deny check box next to the appropriate permissions that are listed for the folder in the preceding scenario.
13. Click OK to apply your changes, and close the Properties dialog box for the folder.
14. Repeat this procedure for each folder for which you are assigning permissions as specified in the preceding scenario.
15. Log off Windows 2000.

In this exercise you log on using various user accounts and test NTFS permissions.

1. Log on as User81, then start Windows Explorer.
2. In Windows Explorer, expand the C:\Data\Managers\Reports directory.
3. Attempt to create a file in the Reports folder.

Were you successful? Why or why not?

4. Log off Windows 2000.

1. Log on as User82, then start Windows Explorer.
2. Expand the C:\Data\Managers\Reports directory.
3. Attempt to create a file in the Reports folder.

Were you successful? Why or why not?

4. Log off Windows 2000.

1. Log on to your domain as Administrator, then start Windows Explorer.
2. Expand the C:\Data\Sales directory.
3. Attempt to create a file in the Sales folder.

Were you successful? Why or why not?

4. Close Windows Explorer, and then log off Windows 2000.

1. Log on as User81, then start Windows Explorer.
2. Expand the C:\Data\Sales directory.
3. Attempt to create a file in the Sales folder.

Were you successful? Why or why not?

1. Log on as User82, then start Windows Explorer.
2. Expand the C:\Data\Sales directory.
3. Attempt to create a file in the Sales folder.

Were you successful? Why or why not?

4. Close all applications, then log off Windows 2000.

Lesson Summary

In this lesson you learned that by default, when you format a volume with NTFS, the Full Control permission is assigned to the Everyone group. You learned that you should change this default permission and assign other appropriate NTFS permissions to control the access that users have to resources. You learned that Administrators, the owners of files or folders, and users with Full Control permission can assign NTFS permissions to users and groups to control access to files and folders. You learned how to assign or modify NTFS permissions for a file or a folder by using the Security tab of the Properties dialog box for the file or folder.

You also learned that by default, subfolders and files inherit permissions that you assign to their parent folder, and you learned how to disable this feature so that subfolders and files do not inherit the permissions assigned to their parents. In the practice exercises, you created some folders, assigned NTFS permissions, and then tested the permissions you set up to determine if you set them up correctly.

Top of Page

Last Updated: Friday, July 6, 2001