What is permission inheritance?

What is permission inheritance?

Every NTFS file and folder has an access control list (ACL) of entries that allow or deny a user or group a set of rights. Most of those entries are not set on the object itself. They flow down from the parent folder: give the Sales group Modify on D:\Sales, and every subfolder and file created inside it gets the same entry. This lets an administrator manage one folder at the top of a tree instead of thousands of files.

Inherited vs explicit permissions

• Inherited permissions come from a parent. On the Security tab their check boxes are grayed out, and in Advanced Security Settings the Inherited from column names the source folder. You cannot edit them on the child; change them at the parent or break inheritance.
• Explicit permissions are set directly on the object. They can add rights beyond what is inherited.

Each folder entry also has an Applies to setting, such as "This folder, subfolders and files" or "This folder only", that controls how far it flows.

Allow, deny and which wins

Permissions from all of a user's groups add together, so Read from one group plus Write from another gives both. A Deny entry overrides an Allow entry at the same level, which is where the exam rule "deny beats allow" comes from. Windows' full order is more precise: explicit Deny, then explicit Allow, then inherited Deny, then inherited Allow. So an explicit Allow set on a file can override a Deny inherited from its parent folder. Use Deny sparingly; removing the user from the group that grants access is usually cleaner.

Disabling inheritance

To give a subfolder different permissions, such as an HR folder inside a shared department folder, open Properties > Security > Advanced and click Disable inheritance. Windows asks what to do with the current inherited entries:

• Convert inherited permissions into explicit permissions on this object: keeps today's access as a starting point you can then trim. This is the safe choice.
• Remove all inherited permissions from this object: leaves only explicit entries. If there are none, no one can open the folder until permissions are added back by its owner or an administrator who takes ownership.

The opposite tool is the check box Replace all child object permission entries with inheritable permission entries from this object, which resets everything below a folder to match it. It cleans up a messy tree, and it wipes out custom permissions if used on the wrong folder.

Command-line equivalents

• icacls D:\Sales lists the ACL. Entries marked (I) are inherited, and (OI)(CI) means the entry passes to files and subfolders.
• icacls D:\Sales\HR /inheritance:d disables inheritance and copies the inherited entries, /inheritance:r removes them, and /inheritance:e turns inheritance back on.
• icacls D:\Sales /reset /T replaces the ACLs on the folder and everything below it with default inherited permissions.

Copying and moving files

If a moved file stays unreadable to people who can open everything else in its new folder, it probably kept its old permissions; reset inheritance on it. When a migration must keep permissions, use robocopy with /COPYALL or /SEC.

Permission inheritance on the CompTIA A+ exam

This concept sits under Core 2 (220-1202) objective 2.2, which covers Windows permissions. Expect questions where a user cannot reach a subfolder, or can reach one they should not: check whether the folder inherits from its parent or has inheritance disabled. Memorize the copy and move table, know that deny overrides allow when both apply at the same level, and remember that NTFS permissions apply both locally and over the network while share permissions apply only over the network.