Outcome 3: Implement secure network administration procedures

Table of Contents

1. Windows Server 2003 Security Features
2. NTFS File and Folder Permissions
   1. Multiple NTFS permissions
   2. Cumulative NTFS permissions
   3. Effective NTFS Permissions
   4. Effective Permissions
   5. Setting NTFS Permissions
   6. NTFS Permissions Inheritance
   7. NTFS Special Access Permissions
   8. Changing Permissions
   9. Taking Ownership
   10. Changing the Owner of a File or Folder
   11. Copying and Moving Files and Folders
   12. Troubleshooting NTFS Permissions
   13. Security Configuration and Analysis
3. Software Update Infrastructure
4. Network Protocol Security
5. Self Assessment Questions (SAQs)
6. Summary: Implementing secure network administration procedures
7. Summary: Software Update infrastructure

NTFS File and Folder Permissions

If you are using the NTFS file system you can control the access that users are allowed to folders (and to the files and subfolders contained within them) by assigning NTFS folder permissions to users and user groups. There are six permissions that you can assign:

• Read: allows the user to see files and subfolders in the folder and view folder ownership, permissions and attributes.

• Write: allows the user to create new files and subfolders within the folder, change folder attributes and view folder ownership and permissions.

• List Folder Contents: allows the user to see the names of files and subfolders in the folder.

• Read & Execute: allows the user to browse through folders to reach other files and folders, even if the users do not have permission for those folders. It also allows the user to perform actions permitted by the Read permission and the List Folder Contents permission.

• Modify: allows the user to delete the folder and perform actions permitted by the Write permission and the Read & Execute permission.

• Full Control: allows the user to change permissions, take ownership, and delete subfolders and files. It also allows the user to perform actions permitted by all other NTFS folder permissions. Administrators, owners of files or folders and users with Full Control permission can assign NTFS permissions to other users and groups.

• Deny: denies a user account or group all access to a folder and denies the Full Control permission.

NTFS file permissions take priority over NTFS folder permissions, so a user or user group with permission to access to a file will be able to access it without permission to access the folder containing the file. This can be done by using the full universal naming convention (UNC) or local path to open the file from an application. The folder in which the file resides will be invisible if the user has no corresponding folder permission. Without permission to access the folder, the user will not see the folder and will not be able to browse for the file.

Next: Multiple NTFS Permissions