This video will look at the advanced permissions available in NTFS. Advanced permissions give the administrator more control over how files and folders can be accessed.
Download the PDF Handout: ITFreeTraining.com/handouts/se...
Advanced/Special Permissions
In older versions of Windows, advanced permissions were referred to as special permissions. There are 14 permissions in total. Depending on whether the permissions are applied at the file or folder level, what effect they have may change. For example, the first permission “List folder/Read Data” when applied at the folder level will allow files to be viewed in the folder, however when applied to a file, will allow the file to be read.
The 6 basic permissions map directly to the 14 advanced permissions. In some cases only one advanced permission maps to one basic permission, in other cases, more than one advanced permission maps to one basic permission. When you select a basic permission, this is essentially selecting the required advanced permissions, however you can press to choose individual advanced permissions if you want.
Example
1) Create a folder on the d drive called Docs
2) Right click the Docs folder, select properties and then select the security tab.
3) To disable inheritance, press the button advanced at the bottom of the security tab and then press the button at the bottom of the Window “Disable inheritance”.
4) When prompted select the option “Remove all inherited permissions from this object”. This will allow us to start with no permissions. An explicit entry will be created which gives all administrators full control.
5) To make changes to permissions, select the permission that you want to change and then press the edit button.
6) By default only the basic permissions will be shown, to show the advanced permissions, select the option “Show advanced permissions”.
7) If you select basic permissions, the advanced permissions will automatically change as required. Essentially the Windows interface shows the basic permissions based on what advanced permissions it has enabled.
8) Once the advanced permissions have been selected press o.k. to go back to the previous screen.
9) It is important to notice that when permissions have been added, there will be a column on the far left that says “applies to”. This will indicate which files and folders the permission will affect.
10) To add a new permission, press the add button. When you add a new permission you will need to select the option “Select a principal”. This is the object that the permission will apply to. For example you could select a user or group here.
11) On the screen is also an option, “Only apply these permissions to objects and/or containers within this container”. If this option is ticked, the permission will only be applied to objects in that folder.
12) When permissions are added or removed, Windows will display the permissions based on what is configured. For example, you may add or remove permissions, however the number of lines of permissions shown may not change, but some of the information that is shown may change.
Advanced permissions
List folder/Read Data: If this is applied to a folder, it allows the user to see a list of files and folders in that folder even if the user does not have any permissions to those files or folders. If the permission is applied to a file, this permission gives the user the ability to read the data in that file.
Read attributes: This includes the basic attributes like read-only, hidden, system and archive. If the user does not have this permission, when they open the properties of a file or folder they will not be able to see the data on the general tab.
Read extended attributes: Extended attributes are attributes that are added using software. This is usually done in alternative operating systems and is rare on Windows operating systems.
Read permissions: This allows the user to read permissions that have been assigned to that file or folder. This essentially allows the user to read the information displayed on the security tab. If the user does not have this permission they will not have access to this tab.
Traverse folder/execute file: If this permission is applied to a file, it allows the user to run that file as an executable.
Description too long for RU-vid. Please see following link for rest of description: http//itfreetraining.com/server#adv-ntfs
See / itfreetraining or itfreetraining.com for our always free training videos. This is only one video from the many free courses available on RU-vid.
References
“Installing and Configuring Windows Server 2012 Exam Ref 70-410” pg 78
“NTFS Permissions, Part 2” technet.microsoft.com/en-us/ma...
5 май 2015
