Re: NTFS Permissions allowing one to RUN APPLICATIONS

From: chaosUnplugged (chaosUnplugged_at_discussions.microsoft.com)
Date: 11/12/05


Date: Sat, 12 Nov 2005 14:40:03 -0800


> (Why would you think "WRITE" would allow anyone to EXECUTE an application?)

I don't. I was challenged by another MCP who stated that "All four choices
(above) allow the running of applications. The only permission that doesn't
is READ, which is not one of the choices." He even went on to cite a support
reference for his opinion (Windows XP Help: Setting Permissions). I wanted
outside/expert opinion on this.

I also just confirmed this by assigning only the WRITE permission to a
folder for "Guests" and the "effective permissions" for "Guests" are: Create
Files/ Write Data, Create Folders / Append Data, Write Attributes, Write
Extended Attributes. WRITE does not include "Traverse Folder/ Execute File".

Thank you very much Shenan for getting back so quickly and for your
confirmation. If you have any further thoughts/advise on this please let me
know and I will pass them on.

Regards,

/s/Norman A. Levinson, MCSE, CCNA, CWSP

"Shenan Stanley" wrote:

> chaosUnplugged wrote:
> > Which NTFS permissions allow users to run applications?
> >
> > Modify (yes)
> > Read and Execute (yes)
> > Full Control (yes)
> > Write (No)
> >
> > It appears that WRITE alone would not allow a user to run
> > applications. Can anyone cite resource to support (or disprove) this
> > and why? Thanks!
>
> Read and Execute is usually all that is needed.
> Anything else may be on a few files for the application - but not the
> executable itself.
>
> (Why would you think "WRITE" would allow anyone to EXECUTE an application?)
>
> http://www.experts-exchange.com/Security/Win_Security/Q_21586050.html
>
> HOW TO: Set, View, Change, or Remove File and
> Folder Permissions
> http://support.microsoft.com/kb/308418
>
> HOW TO: Set the My Documents Folder as Private in Windows XP
> http://support.microsoft.com/kb/298399
>
> HOW TO: Set, View, Change, or Remove Special Permissions
> for Files and Folders
> http://support.microsoft.com/kb/308419
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>



Relevant Pages

  • Re: Executing a Job - permissions / set-up ?
    ... Do you think I need to assign permissions to the folders ... What about the folder that contains the SSIS package itself? ... grant EXECUTE on sp_Test to testUser ...
    (microsoft.public.sqlserver.server)
  • Re: NTFS Security Question.
    ... A subordinate object DOES not inherit the PARENT perms (in ... will assume "Nebulous" permissions that refer to the LINK ... The trick is to PROPOGATE to all FILES (not Folders and Files - that would ... Since Windows 2000 deny NTFS permission does not work ...
    (microsoft.public.windowsxp.security_admin)
  • Re: The application failed to initialize properly
    ... > execute within? ... This is common with applications that were written for older operating ... and look for patches, workarounds, updates. ... and registry entries have permissions that need to be changed. ...
    (microsoft.public.windowsxp.general)
  • RE: ISA 2004 REPORT FAILURE
    ... Did as you suggested and turned auditing on for the system and folders ... that is setting the wrong permissions of the folders ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • RE: ISA 2004 REPORT FAILURE
    ... the ISA Reports still fail because ... I can change the permissions manually ... on the ISALogs and ISASummaries folders ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)