What is the Read & Execute permission?
Read & Execute is one of the standard NTFS permissions in Windows. It lets a user or group view the contents of folders and files, see their attributes and permissions, and run executable files such as programs and scripts. It includes everything in the Read permission plus the right to traverse folders and execute files. It does not allow creating, changing or deleting anything.
Windows relies on it by default: the Users group typically has Read & Execute on folders such as C:\Program Files and C:\Windows, so everyone can run installed software but only administrators can change it.
NTFS standard permissions compared
| Permission | What it allows |
|---|---|
| Full Control | Everything, including changing permissions and taking ownership |
| Modify | Read, run, change and delete files and folders |
| Read & Execute | View files and folders and run programs; inherited by files and subfolders |
| List Folder Contents | The same rights as Read & Execute, but inherited only by subfolders, not files |
| Read | View files, folder contents, attributes and permissions |
| Write | Create files and folders and change file contents and attributes, but not delete |
Share permissions vs. NTFS permissions
A shared folder can have two sets of permissions:
- Share permissions (Read, Change, Full Control) apply only when the folder is reached over the network, through a path like
\\server\share. - NTFS permissions apply both locally and over the network.
When both apply, Windows works out the effective permission from each set and the most restrictive result wins. A user with Full Control on the share but only Read & Execute in NTFS can open and run files over the network but not change them. Signed in at the computer itself, only NTFS permissions count.
Inheritance and Deny
- Permissions set on a folder are inherited by its subfolders and files unless inheritance is disabled (Security tab, then Advanced).
- Copying a file, or moving it to a different volume, gives it the permissions of the destination folder. Moving it within the same NTFS volume keeps its existing permissions.
- A Deny generally overrides an Allow. The exception: an Allow set directly on a file or folder overrides a Deny inherited from a parent folder.
Set permissions on the Security tab of a file or folder's Properties, or from the command line, for example icacls C:\Scripts /grant Users:(OI)(CI)RX to give Users Read & Execute on a folder and everything in it.
For the CompTIA A+ exams
Core 2 (220-1202) covers NTFS and share permissions with the other Windows security settings (objective 2.2), and Core 1 (220-1201) objective 2.3 lists file share servers among the server roles, which is where this course first meets them. Know the six standard permissions, that Read & Execute adds running programs to Read, and that the most restrictive of share and NTFS permissions applies over the network.