RE: Where are NTFS perms stored?

From: egar (egar_at_discussions.microsoft.com)
Date: 11/22/04 

Date: Sun, 21 Nov 2004 20:43:06 -0800

Thanks for the reply Steve. I'm still wondering about this. I thought all the
NTFS perms were based on SIDs. If the perms are on the drive, stored in the
MFT entries, how can you have a system with multiple OSs installed(boot
seperately - one at a time). The 'system' ID may be special. But I'm sure the
Admin ID on each OS instance must have a different local SID. But I've booted
systems into different OS instances, and still have access to all the drives
and directories. This is common when restoring in a DR situation. I've
actually edited the Registry for one OS, while booted into a different OS
instance. It seems that if the NTFS perms are all MFT based, the perms for
the different OS %SystemRoot% would prevent this. Also, if security is all
MFT based, how do the the multiple OS's "share" the MFT?

"Steve Friedl [MVP]" wrote:

> "egar" wrote:
> > Are NTFS permissions stored as part of the data
> > files? Or is all permission data (for all drives) stored in the Registry SAM
> > on the system drive?
>
> NTFS permissions are stored as part of the filesystem itself, in an
> attribute in the Master File Table. No Registry SAM required for this.
>
> http://www.winntmag.com/Articles/Index.cfm?IssueID=27&ArticleID=3455
>
> Steve