Re: Bypassing security

From: Oli Restorick [MVP] (oli_at_mvps.org)
Date: 11/08/03 

Date: Sat, 8 Nov 2003 14:45:05 -0000

Hi there

With NTFS file permissions, a user gets the greatest permission provided by
all the groups and users listed in the access control list.

So, say you'd given the following permissions on a folder:

Everyone: F
Accounts: R

The effective permissions for members of the accounts group will be Full
Control.

When accessing these files through a share, the share permissions work in a
similar way (i.e. you get the greatest permissions on the share's access
control list).

Once you've determined the permissions given on the filesystem (NTFS) and
those given by the share, you have to consider how they interact.

The rule with interaction of share permissions and NTFS permissions is that
the LOWEST permission is what governs the effective permission.

To take an example:

NTFS permissions
Group1:F
Group2:R

Share permissions:
Group1:C
Group2:F

Suppose you have a user who is a member of both the group1 and group2. At
the NTFS level, he will get Full Control by virtue of being in group1. At
the share level, he will get Full Control by virtue of being in group2. The
effective permission for that user accessing the files through the share
will be full control.

Suppose a user is a member of group1. He gets full control at the NTFS
level and change permissions at the share level. Result: change permission.
Although he has full control at the NTFS level, because he's accessing files
through the share, he is restricted to only change.

Finally, if a user is a member only of group2. NTFS=R, Share=F. Result=R

The only exception to this is if you use "Deny", which overrides any other
permission they may have. However, I would strongly recommend against use
of "deny" as you can get in a real mess.

What I do when I create a server is to create a data folder which has full
control for administrators and no permissions for anybody else. Then,
directories created underneath inherit this and it's up to the administrator
creating the directory to give appropriate permissions.

Hope this helps

Oli

"kjnaduvil" <anonymous@discussions.microsoft.com> wrote in message
news:02b301c3a559$f3e8d2a0$a101280a@phx.gbl...
> I have a directory on a Windows 2000 file server (the
> environment is NT4-W2K mixed) for which security has been
> set to Read-Only for a certain global group. However, any
> member of that group is able to bypass security and do
> whatever they want with the contents. I am petrified!
> What should I do to secure it? Your suggestions will be
> greatly appreciated.
>

Relevant Pages

  • Re: Directory Permissions - What gives?
    ... You control security at the NTFS folder ... As far as best practices are concerned in the "old days" as many of ... you do not control security at the Share level. ... You use NTFS Folder and File permissions for that. ...
    (microsoft.public.windows.server.general)
  • Consider Windows XP File Security and Group Policies
    ... If you are running Windows XP and are using the NTFS file system, ... Account from being able to purge its history footprint files. ... Changing Folder permissions to Read-Execute instead of Full ... you globally apply Full Control for the Administrators group and the SYSTEM ...
    (microsoft.public.windowsxp.general)
  • Re: Access denied message even with the Administrator user
    ... I set all to Full Control and still keep getting the Access ... The Share Permissions setting is: ... > This newsgroup only focuses on SBS technical issues. ... you may want to contact Microsoft CSS directly. ...
    (microsoft.public.windows.server.sbs)
  • Re: Permissions Chart ?? or web site ??
    ... Determine what access you get through NTFS ... Share permissions should be set to the MINIMUM required for each GROUP, ... EVERYONE FULL CONTROL but with the security initiatives had MSFT chop that ... Or some web site that helps to understand ...
    (microsoft.public.windows.server.active_directory)
  • Re: Permissions Chart ?? or web site ??
    ... Truly the best way of handling this which gets all of the confusion out of the way is to set the Share permissions to EVERYONE FULL CONTROL and then properly manage the NTFS permissions, then you only worry about the one level of permissions. ... Or some web site that helps to understand ...
    (microsoft.public.windows.server.active_directory)