Permission management is one of the most significant security concepts: ensuring that users have the correct permissions, which typically involves recognizing the difference between share and NTFS permissions.
Share and NTFS permissions operate in slightly different ways, but they both have the same goal: to prevent unauthorized access.
Get the Free Pen Testing Active Directory Environments EBook
“In a way that defensive work never did, this opened my eyes to AD security.”
Users can not access their data if NTFS and share permissions interact or if a shared folder is in a separate shared folder with different share permissions.
So you know what to do, here are the main differences between share and NTFS permissions.
What is NTFS?
A file system is a method of organizing a drive that specifies how data is stored on purpose and what types of information, such as permissions and file names, may be attached to files.
The New Technology File System (NTFS) stands for New Technology File System (NTFS). The Windows NT operating system uses the NTFS file system for storing and accessing files. Before NTFS, Microsoft’s older operating systems used the file allocation table (FAT) file system, optimized for small disks and basic folder structures.
The NTFS file system is more stable than FAT and supports larger file sizes and hard drives. With the introduction of Windows NT 3.1 in 1993, Microsoft first released NTFS. Microsoft’s Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP, Windows 2000, and Windows NT operating systems all use this file system.
NTFS Permissions
NTFS permissions are used to monitor who has access to files and directories in NTFS file systems.
To see what kind of permissions you’ll be granted when you share a file or folder, use the following formula:
- Right-click on the file/folder
- Go to “Properties”
- Click on the “Security” tab
After that, you’ll use this window to navigate:
NTFS provides a few more permission choices, in addition to Full Access, Alter, and Read, which can be set for groups or individuals.
- Full control: Allows users to read, write, change, and delete files and subfolders. Also, users can change permissions settings for all files and subdirectories.
- Modify: Allows users to read and write files and subfolders; also allows deletion of the folder.
- Read & execute: Allows users to view and run executable files, including scripts.
- List folder contents: Permits viewing and listing of files and subfolders as well as executing of files; inherited by folders only.
- Read: Allows users to view the folder and subfolder contents.
- Write: Allows users to add files and subfolders, allows you to write to a file.
If you’ve ever dealt with permissions management in your business, you’ve probably come across the term “broken permissions.” They are, however, repairable.
Share Permissions
A share is when you want to set permissions for a folder that you’ve shared. The form of access others have to the shared folder across the network is decided by share permissions.
To see what kind of permissions you’ll be granted when you share a document, use the following formula:
- Right-click on the folder
- Go to “Properties”
- Click on the “Sharing” tab.
- Click on “Advanced Sharing…”
- Click on “Permissions”
Recommended: RCMP Says Free Trial Scams Are Fraudulent, But Credit Card Companies Make Victims Pay
You’ll then go to this window:
Full Control, Alter, and Read are the three forms of share permissions.
- Full Control: Enables users to “read,” “change,” as well as edit permissions and take ownership of files.
- Change: Change means that the user can read/execute/write/delete folders/files within the share.
- Read: Read allows users to view the folder’s contents.
A Caveat on Share Permissions
Permissions can become complicated and messy when you have several shares on servers nested underneath each other.
For example, if you have a “Read” folder in a subfolder share permission and someone creates a “Modify” share permission above it at a higher root, you can end up with people who have access levels that are higher than you expected.
There is a way around this, as I’ll explain further down.
How to Use Share and NTFS Permissions Together
When configuring protection, one of the most common questions is, “What happens when share and NTFS permissions communicate with each other?”
If you merge share and NTFS permissions, the more restrictive license takes precedence.
Consider the following examples:
If the share permissions are “Read” and the NTFS permissions are “Complete power,” a user will be granted “Read” permission when they enter a file on the share.
If the share permissions are “Complete Control,” but the NTFS permissions are “Read,” a user who accesses a file on the share will still be granted “Read” permission.
Read: The Dangers Of Excessive Permissions
Managing NTFS Permissions and Share Permissions
If you find that managing two sets of permissions is too complicated or time-consuming, you can move to only using NTFS permissions.
With only three types of permissions settings, shared folder permissions provide minimal protection for your folders, as seen in the examples above. As a result, using NTFS permissions to manage access to shared files gives you the most flexibility.
Furthermore, if the resource is accessed locally or over the network, NTFS permissions apply.
To do so, set the folder’s sharing permissions to “Absolute Access.”
After that, you can make whatever adjustments you want to the NTFS permissions without worrying about the share permissions interfering.