What are NTFS permissions?
NTFS stores an access control list with every file and folder. Each entry names a user or group and allows or denies a set of rights. Windows checks that list every time someone opens, changes or deletes the object, whether they are sitting at the PC or connecting through a network share. FAT32 and exFAT have no such lists, which is why permissions disappear when data is copied to most USB flash drives.
The standard permissions
| Permission | What it allows |
|---|---|
| Full control | Everything in Modify, plus changing permissions and taking ownership |
| Modify | Read, write, run and delete the file or folder |
| Read & execute | View contents and run programs and scripts |
| List folder contents | Folders only: see the names of the items inside and traverse the folder |
| Read | Open files and view attributes, permissions and folder contents |
| Write | Create files and folders and change file data, but not delete |
| Special permissions | Checked when an entry uses a custom mix of the advanced rights |
Viewing and changing them
- Right-click the item > Properties > Security tab > Edit to add users or groups and set Allow and Deny boxes.
- Advanced lists every entry with its source, lets you disable inheritance and change the owner, and has an Effective Access tab that calculates what a specific user actually gets.
icaclsshows and sets permissions from the command line. For example,icacls D:\Reports /grant Sales:(OI)(CI)Mgives the Sales group Modify on the folder, its subfolders and files.takeown /f D:\Reports /rtakes ownership when even administrators are locked out. The owner can always change an object's permissions.
How multiple permissions combine
- Cumulative: a user's access is the sum of the entries for the user and every group they belong to.
- Deny wins: a Deny entry overrides an Allow entry at the same level.
- Inheritance: by default, files and subfolders receive the parent folder's permissions, and explicit entries on a child take priority over inherited ones.
NTFS permissions vs share permissions
A shared folder also has a simpler set of share permissions on its Sharing tab: Full Control, Change and Read. Share permissions apply only to connections over the network, while NTFS permissions always apply. For a network connection, Windows evaluates both and the more restrictive result wins.
| Share | NTFS | Access over the network | Access at the PC |
|---|---|---|---|
| Read | Modify | Read | Modify |
| Full Control | Read | Read | Read |
| Change | Modify | Modify | Modify |
A common practice is to set generous share permissions and do the detailed restriction with NTFS, so there is only one detailed set to manage. A share created through Advanced Sharing defaults to Read for Everyone, which explains why a user with NTFS Modify still cannot save to a freshly created share.
Troubleshooting access denied
- Confirm the user's identity and groups with
whoami /groups. Group changes take effect only after the user signs out and back in. - Check the Effective Access tab on the folder for that user.
- If access fails only over the network, compare the share permissions.
- Look for Deny entries and for broken inheritance on the folder.
NTFS permissions on the CompTIA A+ exam
NTFS permissions belong to Core 2 (220-1202) objective 2.2 on Windows users, groups and permissions. Know the standard permissions, that they apply locally and over the network, that share permissions apply only over the network, and that the more restrictive of the two wins for network access. Also know that permissions are cumulative across groups, that deny overrides allow, and that copying files to FAT32 or exFAT drops them.