NTFS File and Folder Permissions
If you are using the NTFS file system you can control the access that users are allowed to folders (and to the files and subfolders contained within them) by assigning NTFS folder permissions to users and user groups. There are six permissions that you can assign:
- Read: allows the user to see files and subfolders in the folder and view folder ownership, permissions and attributes.
- Write: allows the user to create new files and subfolders within the folder, change folder attributes and view folder ownership and permissions.
- List Folder Contents: allows the user to see the names of files and subfolders in the folder.
- Read & Execute: allows the user to browse through folders to reach other files and folders, even if the users do not have permission for those folders. It also allows the user to perform actions permitted by the Read permission and the List Folder Contents permission.
- Modify: allows the user to delete the folder and perform actions permitted by the Write permission and the Read & Execute permission.
- Full Control: allows the user to change permissions, take ownership, and delete subfolders and files. It also allows the user to perform actions permitted by all other NTFS folder permissions. Administrators, owners of files or folders and users with Full Control permission can assign NTFS permissions to other users and groups.
- Deny: denies a user account or group all access to a folder and denies the Full Control permission.
NTFS file permissions take priority over NTFS folder permissions, so a user or user group with permission to access to a file will be able to access it without permission to access the folder containing the file. This can be done by using the full universal naming convention (UNC) or local path to open the file from an application. The folder in which the file resides will be invisible if the user has no corresponding folder permission. Without permission to access the folder, the user will not see the folder and will not be able to browse for the file.