NTFS vs Share Permissions

What does the basic Give access to interface conceal?

some of the complexity of the Windows NTFS versus share permissions system

When do share-level permissions apply?

when a folder is accessed over a network connection

What do share-level permissions not protect against?

a user who is logged on locally to the computer hosting the shared resource

When are NTFS permissions applied?

for both network and local access

What can NTFS permissions be applied to?

folders and individual files

What is better practice than assigning NTFS permissions directly to user accounts?

assign permissions to security groups and make users members of appropriate groups

Which tab is used to configure NTFS permissions for a file or folder?

the Security tab

What does the Security tab show?

the ACL applied to the file or folder

What does each access control entry (ACE) assign?

a set of permissions to a principal

What can a principal be?

a user account or a security group

What do Read/list/execute permissions allow?

open and browse files and folders and run executable files

What does Write allow?

create files and subfolders and append data to files

What does Modify allow?

write permission plus the ability to change existing file data and delete files and folders

What does Full control allow?

all other permissions plus the ability to change permissions and change the owner of the file or folder

How can each permission be configured?

as allow or deny

What takes effect if permissions are not defined?

implicit deny

What are permissions that are defined known as?

explicit

What are permissions that take effect because they are not defined known as?

implicit

How does Windows determine the most effective permissions when a user has multiple permissions?

by analyzing the permissions obtained from different accounts

What is the order of permissions from most restrictive to least restrictive?

Explicit Deny, Explicit Allow, Implicit Deny, Implicit Allow

What does Windows default to if permissions conflict?

the most restrictive permission

If a user gets Read from Sales and Modify from Managers, what is the effective permission?

Modify

What error does Windows display if a user tries to view or save a file with insufficient permissions?

Access Denied

What command can configure file and folder permissions with PowerShell?

icacls

What does icacls allow you to do?

adjust inheritance, remove existing permissions, and grant new permissions for users and groups

What does "Path" specify in icacls?

the file or folder whose permissions you are modifying

What does /inheritance:d do?

disables permission inheritance from the parent folder so the item’s permissions can be managed independently

What does /remove:g GroupOrUser do?

removes all granted (allow) permissions for the specified user or group from the access control list

What does /grant GroupOrUser:(OI)(CI)F do?

grants permissions to a user or group

What does (OI) mean in an icacls grant?

Object Inherit; permissions apply to files within the folder

What does (CI) mean in an icacls grant?

Container Inherit; permissions apply to subfolders within the folder

What does F mean in an icacls grant?

Full control permission

What issue must be considered when folders are secured using NTFS and/or share permissions?

inheritance

What is the default inheritance behavior for NTFS permissions on a folder?

files and subfolders created under the folder automatically inherit the folder’s NTFS permissions

Where can default NTFS inheritance behavior be disabled?

Security Advanced Permission tab

What type of permissions always override inherited permissions?

directly assigned permissions (explicit permissions)

Do explicit permissions override inherited deny permissions?

yes

In the example, if a parent folder denies write but a child file grants write directly, what is the effective permission?

allow write access on the file object

When do share permissions protect a resource?

when it is accessed across the network

When do NTFS permissions apply?

locally and across the network

Where are share permissions set?

at the root of the share

How do share permissions affect files and subdirectories?

all files and subdirectories inherit the same permissions

Why is NTFS inheritance used in combination with share permissions?

to provide greater flexibility, such as placing more restrictive permissions at lower levels in the directory structure

If both share and NTFS permissions apply to the same resource over the network, which applies?

the most restrictive

If Everyone has Read share permission and Users has Modify NTFS permission, what is the effective permission for a Users member over the network?

Read

Which file system can only be protected using share permissions?

FAT32

How are shared folder permissions most often set because the interaction is complex?

Full Control for either the Everyone or Authenticated Users default groups

How are effective permissions most often managed?

using NTFS security

What does the Authenticated Users system group exclude?

guests

What wins when share and NTFS permissions conflict?

the most restrictive permission