Skip to main content

NTFS Permissions

What is a permission?​

A permission is an authorization given to a user or a group of users to perform an action on a file or folder:

  • Read
  • Write
  • Modify
  • Delete
  • List contents (in the case of a folder)

User vs Group​

Permissions are defined for security objects:

  • Local users (e.g., Haythem)
  • Local groups (e.g., Administrators, Users)

A group is a set of users. Permissions can be assigned to a group, and all users in that group inherit these permissions.

warning

If a user belongs to two groups and one of the groups has a denied permission, it takes precedence.

Concept of ownership​

In Windows, each object (file, folder, registry key, etc.) has an owner. The owner has special rights, the most important of which is the ability to modify permissions, even if they do not have full control.

By default, the creator of a file or folder becomes its owner.

Why is this concept important?​

A user may not have read permission, but they can take ownership of the file and modify the ACL (Access Control List).

This can pose a security risk if users can take ownership of sensitive files.

Only administrators (or groups with this right) can change the owner via the graphical interface or tools like takeown and icacls.

Types of NTFS permissions​

NameFileFolder
Read✅ View content✅ List files
Write✅ Modify content✅ Create files
Execute✅ Run an executable✅ Run an executable
Delete✅ Delete the file✅ Delete the folder
Read attributes✅ Read metadata✅ Read metadata
Modify✅ All actions except full control✅ Same
Full control✅ All permissions, including changing owner and permissions✅ Same

Permission inheritance​

By default, permissions are inherited from the parent folder. Inheritance can be disabled to customize permissions.

Modify permissions​

Graphical method (Windows Explorer)​

  • Right-click on the file/folder → Properties
  • Security tab
  • Edit… button
  • Add or remove a user/group
  • Check permissions to Allow or Deny

Command line method​

  • icacls: Displays and modifies NTFS permissions
  • takeown: Takes ownership of a file or folder

Network sharing​

Be careful, network shares have their own permissions, in addition to NTFS (double control!).