Shulou(Shulou.com)06/01 Report--

1.1.1 introduction to NTFS permissions

When a user tries to access a file or folder, the NTFS file system checks whether the account or group to which the account belongs is in the access control list (ACL) of the file or folder, further checks the access control entry (ACE), and then determines the user's final permissions based on the permissions in the control. If the account used by the user or the group to which the account belongs does not exist in the access control list, the user is denied access.

There are 7 NTFS security permissions for folders and 6 NTFS security permissions for files, without the permission to list folder directories.

Full control: all operations can be performed on files or folders.

Modify: you can modify or delete files or folders.

Read and run: you can read the content and execute the application.

List folder directories: you can list the contents of a folder, and this permission exists only for folders.

Read: you can read the contents of a file or folder.

Write: you can create files or folders.

Special permissions: other infrequent permissions, such as the right to delete permissions.

All permissions have corresponding "allow" and "deny" options. The default permission for a file or folder is to inherit the permissions of the folder one level above. If it is a folder under the root directory (such as c:\), the permission is to inherit the permissions of the disk partition.

1.1.2 rules for applying NTFS permissions

The following is the rules for the application of NTF security permissions.

Permissions are cumulative.

When a user belongs to multiple groups, the user will get cumulative permissions for each group, but once the corresponding permission of a group is denied, this permission of the user will also be denied, for example:

If there is a user USER, if USER belongs to groups An and B, group A has read permission to a file, group B has write permission to the file, and USER has the permission to modify the file, then the final permission of USER to this file is read + write + modify permission.

Inheritance of permissions.

The newly created file or folder automatically inherits the NTFS permissions of the higher-level directory or drive, as shown in the figure, but the permissions inherited from the previous level cannot be directly modified and other permissions can only be added on this basis. In other words, you can't uncheck the permissions.

Of course, this is not absolute, as long as you have sufficient permissions, such as you are an administrator, you can also modify the inherited permissions, or make the files no longer inherit the NTFS permissions of the previous directory or drive.

Denial of authority

The right to refuse takes precedence over allowed permissions. No matter what permission is given to the user account, as long as the deny permission is set, then the denied permission is absolutely valid.

Impact of move and copy operations on permissions

There are three situations, the same NTFS partition, different NTFS partition, and FAT partition, as shown in the following table.

Same NTFS partition

Different NTFS partitions

FAT partition

Copy

Inherit destination file (folder) permissions

Inherit destination file (folder) permissions

Lose permission

move

Retain the original file (folder) permissions

Inherit destination file (folder) permissions

Lose permission

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.